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Abstract 

In concurrent process theory, processes are often modeled by state machines and Petri Nets. 
Algebraic process theories based on state machines, exemplified by Milner's CCS and Hoare's 
CSP, have been more fully developed than Net-based theories, but are inadequate for modeling 
"true" concurrency concepts such as non-atomic actions, action refinement, locality of actions, 
and multithreadedness. We introduce an action refinement operator and present some "fully 
abstract" semantics for "true" concurrency. We show that these semantics are decidable for 
finite-state concurrent processes and characterize their computational complexity. 
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Chapter 1 

Introduction 



In concurrent process theory, processes are often represented by state machines and Petri Nets. 
State machines, by definition, have no explicit representation of concurrency, and they iden- 
tify concurrent actions with sequential, interleaved actions. Process theories based on state 
machines, exemplified by Milner's CCS [30] and Hoare's CSP [21], typically have associated 
combinators for composing large processes from smaller components, compositional techniques 
for reasoning about processes through reasoning about their components, sound and complete 
techniques for reasoning about process equivalence, and algorithms for deciding equivalence of 
finite-state processes. These elegant properties have led to automatic verification techniques 
and tools such as model checkers. 

However, as is well-known, the state machine approach is inherently inadequate for describ- 
ing action refinement, the operation of refining atomic actions in a concurrent process, which 
suggests aspects of top-down "modular" development [1, 2, 3, 10, 16, 20, 32, 39, 40, 41, 47] 
and "changes of granularity" [28, 31]. This limitation is a direct result of the identification of 
concurrent actions with sequential, interleaved actions. For example, the state-machine repre- 
sentation of the concurrent process a \\ b, which can concurrently perform an a and b action, 
is identical to the state-machine representation of the purely sequential process ab + ba, which 
can sequentially perform an a and b action in either order. This state-machine is pictured in 
Figure 1-1. 
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Figure 1-1: State-Machine Representation of a \\ b and ab + ba 



11 



12 



CHAPTER 1. INTRODUCTION 



start 

O 
"/ \ 

o o 



o o 




o 

S P lit (a,a + ,a.)( ab + ba ) 



start 




S P%,a+,a_)0 II h ) 



Figure 1-2: After Action Refinement 



Now, if the a action in both processes is "refined" or "split" into two actions, a + followed 
by a_, the resulting processes, split a a a _\(a \\ b) = a + a_ \\ b and split a a a _\(ab + ba) = 
a + a_b -\-ba + a_ have completely different state-machine representations, pictured in Figure 1-2. 
Thus, the state machine model is inherently inadequate for describing even the simplest forms 
of action refinement on concurrent processes. In particular, the state machines of Figure 1-2 are 
distinguished by all the state-machine based process equivalences in the literature, including 
bisimulation equivalence (CCS) [30], partial-trace equivalence, failures equivalence (CSP) [8, 9], 
and Hennessy's Testing-equivalence [19], an elegant experimental justification for partial-traces 
and failures. 

We remark that the operation of refining transitions in a state-machine does model action 
refinement of purely sequential processes. Moreover, trace equivalence, failures equivalence, 
Testing-equivalence, and intuitively simple variations of bisimulation, notably delay bisimula- 
tion and branching bisimulation [12, 13, 43] are sound techniques for reasoning about action 
refinement on purely sequential processes. However, since all of these equivalences identify 
concurrent actions with interleaved actions, none of them are sound for reasoning about action 
refinement on concurrent processes. 

Petri Net theory, on the other hand does distinguish "true" concurrency from interleaving 
by axiomatizing a "causal" partial order on process actions, and is adequate for describing 
action refinement of concurrent processes. However, Petri Net theory typically does not offer 
an explanation of how an external observer can detect causality. Hence, in contrast to the state- 
machine theories, Petri Net theory does not provide complete techniques for reasoning about 
process equivalence, and compositional reasoning techniques and associated decision procedures 
are also much less developed. 

An important problem is to merge these viewpoints by developing an operational net model 
for process theories such as CCS and CSP that has a sound and complete justification for dis- 
tinguishing processes. This requires a precise characterization of which nets are distinguishable 
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by any external observer — who sees only sequential behavior — performing action refinement 
and the CCS/CSP-style operations. To this end, it is useful to develop a "fully abstract" 
denotational semantics that precisely captures these distinctions. In contrast to purely oper- 
ational characterizations, which are implicitly quantified over an infinite number of contexts, 
fully abstract semantics have the advantage that they often lead to a semantic foundation for 
recursively- defined processes, logical foundations for proving equivalence of (possibly infinite- 
state) processes, and decision procedures for equivalence of finite-state processes. 

Definition 1.0.1 A semantics, [•], assigning to any process, P, a meaning, [P], is composi- 
tional for an operator on processes if semantic equality is a congruence for the operator, i.e., the 
operator preserves semantic equality. We say that a semantics is adequate for an equivalence 
on processes if semantic equality implies process equivalence. Finally, we say that a semantics 
is fully abstract for a process equivalence with respect to a set of operators if semantic equality 
is the coarsest congruence for those operators that is adequate for the equivalence. 

1.1 True Concurrency Semantics and Action Refinement on 
Petri Nets 

A starting point for such an investigation is to apply state-machine-based equivalences to Petri 
Nets. It is well-known [10] that these equivalences, including partial traces, failures, bisim- 
ulation, and Testing-equivalence, are not compositional for even very simple forms of action 
refinement on Petri Nets, including those whose only effect is to "split" actions into two parts. 

In a seminal paper [47], Vogler has developed a semantics for labeled, 1-safe Petri Nets 
that is compositional for certain simple "split" and "choice" refinements, and indeed is fully 
abstract for failures semantics [9] and Hennessy's MUST-experiments [19]. Furthermore, his 
semantics supports a full process theory involving CSP-style parallel process composition-with- 
communication, hiding, deadlock, and divergences (c/. [9, 19, 21, 30]). Vogler's semantics is 
based on "pomset-traces," which are a generalization of ordinary traces, i.e., sequences of 
visible actions, to multi-sets of actions partially ordered to reflect causality and concurrency. 
In particular, his semantics consists of "interval pomset-failures" : namely, pomset-traces with 
a certain "interval" order, paired with "failure sets" [8, 9, 21]. 

Vogler's elegant insight is that pomset-failures are not compositional for split refinements, 
since these refinements reveal "failure sets" of nets when transitions have "half-fired" : that is, 
when all tokens have been removed from the preset of the transition but no tokens have been 
added to the postset. Vogler's technical solution is to specify some maximal events of pomset- 
traces to be "half-fired" and to keep track of the corresponding failure sets. The fully abstract 
semantics for non-divergent nets is obtained by performing certain closure operations and then 
restricting to interval orders. This is extended to a fully abstract semantics for divergent nets 
by additionally keeping track of "divergent" pomset-traces (with half-fired events), performing 
certain closure operations, and then again restricting to interval orders. 

Although Vogler's insight about half-fired transitions is quite elegant, the "half-fired events" 
in his pomset-failures make the definition of his semantics and his proofs of compositionality 
quite difficult to understand. Furthermore, as Vogler points out, his "general pomset" semantics 
for divergent nets, i.e., the intermediate semantics obtained before restricting to interval orders, 
is not compositional for split and choice refinements, and he states and leaves open [47, 49] the 
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problem of identifying such a semantics that is compositional. As a consequence, his closure 
operations become rather technically complicated. 

Vogler generalizes his simple split and choice refinements to allow a fairly large class of 
"refinement nets" required to satisfy some structural and behavioral conditions, which are 
rather technical and quite restrictive. His semantics is compositional with respect to each of 
the operators corresponding to his refinement nets. Namely, if two nets are equivalent under his 
semantics, then applying the same action refinement p to them yields semantically equivalent 
nets. 

However, it is not the case that his semantics is compositional for nets as action refinement 
operators. For example, the nets a and T.a, where r is the hidden action, are semantically 
equivalent as operands or targets of action refinement, but they behave differently when used 
as operators refining an action b, viz., 

H =vo g ier Ir.a] , 

but {(b + c)[b:=a]j A^ier {(b+ c)[b:=T.a]j. 

In this thesis, we simplify and extend Vogler's results in a number of ways. We first present 
a general class of Well Terminating (WT) Nets, which are possibly infinite, safe nets with 
designated transitions for signaling successful termination. We then present WT Net opera- 
tors corresponding to the familiar CCS/CSP operations of prefixing (a.), restriction (\a), hid- 
ing ( — a), renaming ([/]), CSP-style sequencing (;), non- communicating parallel composition 
(||), CSP-style parallel-composition-with-synchronization (||l), CCS-style parallel-composition- 
with-hiding (|), internal choice, and CCS-style choice (+m)- All of our net operations are closely 
related to the corresponding CCS/CSP operators on labeled transition systems (/fs's). 

The first main result of this thesis is that rather than keeping track of the technically 
cumbersome half-fired events, it is sufficient to first simply "duplicate-and-split" all the visible 
transitions in a net and then take the ordinary pomset-failures of the "duplicate-split" net. For 
divergent nets, one must also keep track of "pomset-divergences": namely, pomsets together 
with an explicit representation of the possibly concurrent divergences that are enabled. Per- 
forming some natural closure operations then yields a "general pomset" semantics, [-]^ t s I, that 
is compositional for split refinements, choice refinements, and all of the CCS/CSP operators 
on WT Nets, and whose restriction, [•] 1 ^f.T, to interval pomsets is fully abstract for MUST- 
equivalence. We describe a similar fully abstract semantics, [-]^y, for MAY-equivalence [19] 
based on "pomset-traces"; the MAY- and MUST-semantics together provide a fully abstract 
semantics for Testing Equivalence [19]. 

Our semantics greatly simplify Vogler's representation by avoiding "half-fired" events; fur- 
thermore, keeping track of concurrent divergences simplifies the closure operations and yields 
compositionality of the [-]^ t s I semantics. This generalizes Vogler's results and solves the open 
problem mentioned earlier. 

This thesis then presents a class of Refinable Well- Terminating (RWT) Nets, which form a 
large subclass of WT Nets that is closed under almost all of the WT operations, together with 
a definition of action refinement that allows any RWT net to be used as a target or operator 
of action refinement. The second main result of this thesis is that in contrast to Vogler's 
semantics, all of our semantics are compositional for RWT Nets as targets and operators of 
action refinement, with the [-]^y and [•] 1 ^f.T semantics remaining fully abstract for MAY- and 
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MUST-equi valence. 

1.2 The Semantic Domains and Recursion 

In order to ensure that our semantic theories support recursively- defined concurrent processes, 
we present an abstract characterization of all our semantics. Our semantic domains form 
algebraic complete partial orders in which all compact elements are definable as the meanings 
of WT Nets, and all of our operators are continuous functions. 

1.3 Deciding True Concurrency Equivalences 

The decision problem for finite-state concurrent processes under a variety of interleaving se- 
mantics has been widely studied in the literature, and the computation complexity has been 
tightly characterized [4, 26, 29, 34, 36]. In contrast, there have been essentially no results on the 
complexity of the decision problems for true concurrency equivalences on finite-state concurrent 
processes, and little is even known about the decidability of these equivalences. For example, 
decidability of such a basic true concurrency property as pomset-trace equivalence appears not 
to have been known. 

One of the main results of this thesis is that pomset-trace equivalence is decidable for finite 
1-safe Petri Nets, and is, in fact, complete for EXPSPACE. Furthermore, we show that the 
decision problem for history-preserving bisimulation [5, 35, 39, 44, 46] on finite 1-safe Petri 
nets is complete for DEXPTIME. History-preserving bisimulation had earlier been shown by 
Vogler [46] to be decidable; however, he left open its complexity. 

In contrast to interleaving equivalences, the decidability of pomset-trace equivalence for 
finite nets does not obviously reduce to equivalence of finite automata. The difficulty is that 
the causal ordering in a pomset-trace depends a priori on the entire pomset-trace, which may be 
unboundedly large. Inspired by Vogler's decision procedure for history-preserving bisimulation, 
we show that there is in fact a bound on the required information. This idea leads to our 
decision procedure for pomset-trace equivalence, and a simple analysis of this procedure yields 
an EXPSPACE upper bound. The same approach also gives a DEXPTIME decision procedure 
for history-preserving bisimulation. Our lower bounds for these true concurrency equivalences 
follow easily by reductions from the corresponding interleaving equivalences [29, 34, 36]. 

Our methods also yield tight complexity bounds for about a dozen other true concurrency 
equivalences, several of which resolve open problems in the literature. 

1.4 Outline of the Thesis 

Chapter 2 presents our class of Well- Terminating Nets together with split refinements, choice 
refinements, and our CCS/CSP operators. A brief introduction to Hennessy's experiments, 
Testing-equivalence, partial trace semantics and failures semantics is given in Chapter 3. We 
then develop our true concurrency semantics for Well- Terminating Nets, prove that they are 
compositional for all our Net operators and adequate for MAY- and MUST-equivalence, and show 
that their "interval" restrictions are fully abstract. The corresponding semantic domains are 
developed in Chapter 4. 
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Chapter 5 presents our action refinement operator, and shows that our semantics are com- 
positional and our semantic domains are closed under this operator. Our decidability results for 
true concurrency equivalences appear in Chapter 6. This chapter is self-contained, and hence 
repeats some earlier definitions. Chapter 7 concludes with a discussion of some further results, 
open problems, and future work. 



Chapter 2 

Well- Terminating Nets and 
Operations 

2.1 Well- Terminating Nets 

Throughout this thesis, we use the standard definitions (c/. [46]) of Petri Nets and their oper- 
ational behavior. In order to keep this thesis relatively self-contained, we repeat them here: 

Definition 2.1.1 A labeled Petri Net, N, is a triple (Sn,T n , Start N ), where Sn is the set 
of places, T/v is the set of transitions, and Start N is the set of initially marked places (which 
contain "tokens"). Every transition, t, in T N has a label, /jv(i), a preset, pre N (t), and a post-set, 
post N (t). We refer to the label r as the "hidden action", and refer to all labels other than r 
as "visible actions". A transition is visible (hidden) iff its label is visible (hidden). For every 
place s G S^, we write pre N (s) and post N (s) to refer to its preset and post-set. We assume for 
expository simplicity that all transitions have non-empty presets, and that the initial marking 
is non-empty. 

Transitions are represented graphically as horizontal bars, places are represented as circles, 
and tokens are represented as dots in these circles. The preset of a transition is the set of places 
from which there is an arrow to the transition; the post-set of a transition is the set of places 
to which there is an arrow from the transition. Dually, the preset (post-set) of a place is the 
set of transitions from (to) which there is an arrow to (from) the place. 

A marking of a net is an assignment of a non-negative number of "tokens" to each place in 
the net. A transition, t, is enabled under a marking iff every place in the preset of t contains at 
least one token. If a transition t is enabled in a marking, then t can fire by removing a token 
from each place in its preset and placing a token into each place in its post-set. 

A firing sequence of a net, N, is a possibly empty sequence, t x ■ ■ -t k , of transitions of N 
such that ti is enabled under the initial marking of N, and each i, is successively enabled in 
the marking resulting from firing t x ■ ■ -t{-\. A run is a finite firing sequence. The reachable 
markings of a net are exactly those markings that result from firing some run. A net is 1-safe 
iff every place contains at most one token under any reachable marking. Rather than being 
represented as a function from places to non-negative integers, a marking of a 1-safe net can be 
written as the set of places that contain a token. 

17 
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A pair of transitions, t and t' , can fire concurrently in a 1-safe net iff the union of the preset 
and post-set of t is disjoint from that of t' and there is a reachable marking in which both t 
and t' are enabled. 

Our class of "Well- Terminating" Nets is related to the class of CSP processes that signal 
successful termination by performing a distinguished action, y/. In a similar manner, our well- 
terminating nets signal successful termination by firing any transition labeled with y/. In order 
to ensure that the net has actually terminated, we require that all places in the net be unmarked 
after any ^/-labeled transition fires. We wish to restrict our attention to labeled, 1-safe nets 
with "computable behavior," and we thus impose some syntactic and behavioral restrictions 
that guarantee finite-markings and finite-branching of the underlying transition system. 

Definition 2.1.2 The class of Well- Terminating (WT) Nets consists of pairs (N,Act) such 
that Act is a finite set of visible labels containing y/ and N is a 1-safe, possibly infinite Petri 
net, all of whose transitions are labeled with actions in ActU {r}. Furthermore, N must satisfy 
the following properties: 

• The initial marking is finite. 

• The preset and post-set of every transition is finite. 

• Only a finite number of transitions are enabled under any reachable marking. 

• All places are unmarked immediately after any ^/-labeled transition fires. This condition 
must be satisfied in every reachable marking. 

We note that these conditions together imply that all reachable markings are finite and that 
nets have only finite concurrency. The condition on the ^/-transitions ensures that no transition 
(not even a ^/-transition) can be fired concurrently with, or following, a ^/-transition. 

Our -^/-labeled transitions serve to distinguish deadlock from successful termination. We say 
that a net successfully terminates when a -^/-labeled transition fires, while a net is deadlocked 
exactly when no transition is enabled. The -y/- action plays a distinguished role in our theory, 
and our net operators are defined in a way that respects this distinguished role. 

WT Nets form natural isomorphism classes: 

Definition 2.1.3 Let (Ni,Act) and (N 2 ,Act) be WT Nets over a common alphabet, Act. 
Then (Ni,Act) and (N 2 ,Act) are isomorphic iff there is a bijection / from S^ to S^ 2 and a 
bijection g from T Nl to T N2 such that Start N2 = f(Start Nl ), and l N2 (g(t)) = /jvi(£), pre N2 (g(tj) = 
f(pre Ni (t)), and post N2 (g(t)) = f(post Ni (tj) for every t £ T Nl . 

In order to view WT Nets as an operational model for CCS and CSP, we will find it useful 
to represent the behavior of nets as labeled transition systems. The following definition is 
standard and is essentially taken verbatim from [19]. 

Definition 2.1.4 A labeled transition system (Its) is a triple (S,Act, — SSinit), where 

• S is a set of states containing Si n it- 

• Act is a set of labels. 
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• — ► is a relation in S X Act xS. 

• s init is designated as the "initial state" in S . 

We write s — ► s' in place of (s,a, s') G — ► . The relations — ► are extended to relations 
— >, for every v G ^4c£*, in the obvious way: 

1. s — ► s' iff s' is s 

2. s — ► s' iff s — > s" for some s" such that s" — > s' . 

This means s — ► s' if s can evolve to s' by performing the sequence of actions v. We also 
write s — ► to mean that there exists a s' such that s — > s' . We say that an action, a, is 
enabled at a state, s, iff s — >. 

If ^4c£ contains the label r, these relations are generalized as follows, for every v G Act*: 

1. s =>■ s' iff s — ► Si — ^ s 2 — > s' for some states s l7 s 2 and some i,j>0 

2. s =>■ s' iff s — > s' for some k > 

3. s =>■ s' iff s =>■ s" for some s" such that s" =^> s' . 

This means s =>■ s' if s can evolve to s' by performing the sequence of actions v, possibly 
interspersed with r-actions. We also write s =>■ to mean that there exists a s' such that 
s =^ s . 

The following definition is essentially standard (c/. [33]): 

Definition 2.1.5 The labeled transition system of a WT Net (N,Act), written lts((N,Act)), 
is the labeled transition system over Act U {r} whose states are the reachable markings of N 
and whose labeled transitions correspond to firings of single transitions of N. In particular, 
state M goes to state M' via an a-labeled transition in lts((N , Act)) iff marking M' of iV can 
be reached from marking M by firing exactly some a-labeled transition of N. The initial state 
of lts((N, Act)) is defined to be the initial marking of N. 

We note that Definition 2.1.2 ensures that the labeled transition system of every WT Net 
is finitely-branching. 

2.2 Operations on Well- Terminating Nets 

This section defines WT Net operators corresponding to the familiar CCS/CSP operations 
of prefixing (a.), restriction (\a), hiding ( — a), renaming ([/]), CSP-style sequencing (;), non- 
communicating parallel composition (||), CSP-style parallel-composition- with-synchronization 
(||i), CCS-style parallel-composition-with-hiding (|), internal choice (©), and CCS-style choice 
(+m)- We also define split a a a _\ and choice^ t a L ,a R ) refinement operators on WT Nets. 
We begin by defining operators that grow or shrink the alphabet of nets: 

Definition 2.2.1 Let (JV, Act) be a WT Net, and let Act' be a finite set of visible labels. Then 
(N,Act) grow Act' = f (N, Act U Act'). 
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Figure 2-1: An Example of Prefixing 

Definition 2.2.2 Let (JV, Act) be a WT Net, and let Act' C Act be a finite set of visible labels 
containing y/. Then (N,Act) shrink Act' = (P,Act'), where P is identical to N except that all 
(visible) transitions with labels from Act — Act' are removed. In particular, 
T P = {t e T N : l N {t) e Act' U {r}}. 

The hiding and renaming operators simply relabel transitions: 

Definition 2.2.3 Let {N,Act) be a WT Net, and let a be a label in Act -{y/}. Then 
(N,Act)— a = (P,Act), where P is identical to N except that all a-labeled transitions are 
relabeled with r. 

Definition 2.2.4 Let (JV, Act) be a WT Net, and let / be function from Act to Act such that 
for ah [1 e Act, f(/3) = y/ iff [1 = yj . Then (N,Act)[f] = (P,Act), where P is identical to N 
except that l P = f o l N . 

The restriction operator simply removes transitions: 

Definition 2.2.5 Let {N,Act) be a WT Net, and let a be a label in Act -{y/}. Then 
(N,Act)\a = (P,Act), where P is identical to N except that all a-labeled transitions are 
removed. In particular, T P = {t £ T N : /jv(i) j^ a}. 

The prefixing operator (a.), illustrated in Figure 2-1, simply attaches a new place and a 
new a-labeled transition to the "start" of a net: 

Definition 2.2.6 Let {N,Act) be a WT Net, and let a be a label in (ActU{T}) - {y/}. Then 
(P,Act) = a.(N,Act) is defined as: 

S P = S N l+J {s a } 
T P = T N \S {t a } 

pre (t) = l {Sa} if * = *« 
( pre N (t) otherwise 
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Figure 2-2: An Example of Sequencing 




Start N if t = t a 
post N (t) otherwise 

a if t = t a 

In if) otherwise 



Our sequencing operator (Ni,Act); (N 2 ,Act) makes critical use of the ^/-transitions of JVi 
by relabeling them with r and using them as a hidden (r-labeled) signal to transfer control to 
N 2 . We illustrate the definition of "sequencing" through the following simple example. Suppose 
that we are given the WT nets (Ni,Act) and (N 2 ,Act) of Figure 2-2, and we want to define 
(Ni,Act); (N 2 ,Act). We want the firing of either of the -^/-transitions of JVi to be a hidden 
signal that enables both b\ and b 2 to fire concurrently. Therefore, we relabel the -^/-transitions 
of JVi to r, and then have both of these r-transitions feed into both of the start places of N 2 . 
The resulting net (Ni, Act); {N 2 , Act) is given in Figure 2-2. The formal definition appears 
below. 
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Definition 2.2.7 Let (Ni,Act),(N 2 ,Act) be WT Nets with disjoint sets of places and tran- 
sitions and with a common alphabet, Act. Then (P,Act) = (Ni,Act);(N 2 ,Act) is defined 



as: 



Dp — iJJVi U "JV2 



T P — T Nl U T/y 2 



pre P {t) 



post P (t) 



l P (t) 



pre Ni (t) if t G T Nl 
pre N2 (t) if te T N2 

post Ni (t) if t G T Nl and l Nl (t) ^ y/ 
Start N2 if t G T Nl and /^ (t) = yj 
post N2 (t) if t G T N2 

' l Nl (t) ifteT Nl and /^(i) 7V 
r if t G T Nl and /^ (t) = yj 

l Na (t) ifteT N2 



Startp = Start Nl 

Our non- communicating parallel composition operator ||, places two nets in parallel. In 
order to preserve the well-terminating property associated with ^/-transitions, the nets are 
required synchronize on the ^/-action. Our definition is illustrated in Figure 2-3. 

Definition 2.2.8 Let (Ni, Act) , (N 2 , Act) be WT Nets with disjoint sets of places and transi- 
tions and with a common alphabet, Act. 

Then {P,Act) = {N u Act) \\ {N 2 ,Act) is defined as: 



bp — JW, U J 



N U Ojy 2 



T P = {(t u t 2 ) G T Nl X T N2 : /^(ii) = l Na (t 2 ) = y/} l±l 

{(t, *) G T Nl X {*} : l Nl (t) ^ y/} l±l {(*,*) G {*} X T^ : l Na (t) ? V} 

pre P {{t u t 2 )) =pre Ni {t l )\Jpre N2 {t 2 ) 
Prep((t,*)) = pre Nl (t) 
pre P ((*,t)) =pre N (t) 



post P ((t 1 ,t 2 )) = post^ti) U post N2 (t 2 ) 
post P ((t,*)) =post Ni {t) 
post P ((*,t)) =post N {t) 
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Figure 2-3: An Example of Non- communicating Parallel Composition 
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Figure 2-4: An Example of CSP-style Parallel Composition 



i P ((ti,t 2 )) = V 
lp((t,*)) = l N1 (t) 
lp((*,t)) = l Na (t) 

Startp = Start Nl U Start N2 



We also have a family of CSP-style parallel composition operators \\ L , where L is a set of 
visible labels. This operator places two nets in parallel and requires them to synchronize on all 
actions in the set IU{^/}. In particular, the non- communicating parallel composition operator 
is definable as ||0. 

Our definition is essentially the same as [47], and is illustrated in Figure 2-4. 



Definition 2.2.9 Let (Ni, Act) , (N 2 , Act) be WT Nets with disjoint sets of places and transi- 
tions and with a common alphabet, Act. Let L C Act, and let L^j = IU {\/}- 
Then {P,Act) = {N 1 ,Act)\\ L {N 2 ,Act) is defined as: 
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Jp — J M. U J 



JV U Ojv 2 



Tp = {(t u t 2 ) G T Nl X T N2 : l^it,) = l Na (t 2 ) and l^) G iy} l±l 

{(i, *) G r Nl X {*} : l Nl (t) i L v } (±1 {(*,*) G {*} X T N2 : Z„ a (i) £ L v } 

pre P {{t u t 2 )) = pre Ni {t{) U pre Na {t 2 ) 
Prep((t,*)) = pre Nl (t) 
pre P ((*,t)) = pre Na (t) 

post P ({t 1 ,t 2 )) = post Ni (ti) U post Na (t 2 ) 
post P ((t,*)) = post Ni {t) 
post P ((*,t)) = post Na {t) 

i P {(tuh)) = i Nl {t l ) 

lp((t,*)) = l N1 (t) 
lp((*,t)) = l Na (t) 

Startp = Start Nl U Start N2 



Similar to [15], we also have a CCS-style parallel composition operator |, where two nets 
are placed in parallel and are allowed to perform hidden synchronizations on all complemen- 
tary actions a, a; however, they must (visibly) synchronize on the y/ action. Our definition is 
illustrated in Figure 2-5. 

We say that an alphabet Act is closed under complementation iff for all labels, a G Act 
implies that a G Act, where a = a. 

Definition 2.2.10 Let (Ni,Act), (N 2 ,Act) be WT Nets with disjoint sets of places and transi- 
tions and with a common alphabet, Act, such that Act —{\/} is closed under complementation. 
Then (P,Act) = (N l ,Act) \ (N 2 ,Act) is defined as: 



op — ijjVi U Ojv 2 

T P = {t G T Nl : l Nl (t) /Vl^Oe T Na : l Na (t) ± ^} l±l 

{(tuh) G T Nl X T N2 : l Nl (h) = l N (t 2 ) ot l Nl (h) = l N2 (t 2 ) = y/} 

pre P {{t u t 2 )) = pre^ti) U pre Na (t 2 ) 
pre P ((t,*)) = pre Ni {t) 
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Figure 2-5: An Example of CCS-style Parallel Composition 
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Figure 2-6: An Example of Internal Choice 



prep((*,t)) = pre N2 (t) 

post P {(t u t 2 )) = post Ni (ti) U po.st N2 (t 2 ) 
post P ((t,*)) = post Ni {t) 
post P ((*,t)) = post N {t) 



lp((tl,t 2 )) 



V if InM = l N3 (t 2 ) 
t otherwise 



V 



lp((t,*)) = l N1 (t) 
lp((*,t)) = l Na (t) 

Startp = Start Nl U Start N2 



We now define the internal choice operator, illustrated in Figure 2-6, which corresponds to 
prefixing each net with r, and then "merging" the resulting (necessarily exactly two) initially 
marked places: 

Definition 2.2.11 Let (Ni, Act) , (N 2 , Act) be WT Nets with disjoint sets of places and tran- 
sitions and with a common alphabet, Act. Then (P,Act) = (Ni,Act) © (N 2 ,Act) is defined 



28 



CHAPTER 2. WELL-TERMINATING NETS AND OPERATIONS 



as: 



S P = S Nl S S N2 S {s} 



T P = T Nl l+J Tjv 2 S {ii,^}? where t 1; t 2 are distinct 



pre P (t) 



postpit) 



hit) 



w 


if t = ti or t = t 2 


pre Ni {t) 


if t e T Nl 


pre Na (t) 


if t e T Na 


Start Nl 


if t = t x 


Start N2 


if * = * 2 


post N ~{t) 


if < g r Nl 


post N2 {t) 


if i G T N2 



t if i = ti or i 

/ Nl (i) ifiGr Nl 



Startp = {s} 

We also wish to define the Milner's CCS choice operator, +m 5 which allows non-deterministic 
choice between two nets. We illustrate the definition of -\- M through the following simple 
example. Suppose that we are given the WT nets (Ni,Act) and (N 2 ,Act) of Figure 2-7, and 
we want to define (Ni,Act) -\- M (N 2 ,Act). Clearly, we want to introduce conflicts between the 
a, and the bj but preserve the concurrency within the bj, and so we do a simple cross product 
construction on the start places of both nets. We note that this causes all the -^/-labeled 
transitions to be in conflict, as desired. The resulting net is given in Figure 2-7. 

As discussed in [42], one technical complication arises due to initially marked places that 
have incoming transitions, and in general, we apply a start-unwinding operator on nets before 
doing the above construction. Our start-unwinding operator, illustrated in Figure 2-8, is es- 
sentially the same as that of [15, 42] and produces a net that is "essentially the same" 1 as the 
original net, except that all initially marked places have empty presets. The "start-unwound" 
net is identical to the original net whenever all initially marked places of the original net have 
empty presets. 

Definition 2.2.12 Let (N,Act) be a WT net, and let Start-cyclic N be the initially marked 
places of N that have non-empty presets, i.e., Start-cyclic N = {s £ Start N : pre N (s) ^ 0}. Then 
(P,Act) = start-unwind((N , Act)) is defined as: 



Sp = Sn W {(*, s) : s G Start- cy die N } 



The resulting net is strongly history-preserving bisimilar [39] to the original net. 
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Figure 2-7: An Example of CCS-style Choice 
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Figure 2-8: An Example of Start-Unwinding 
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T P = T N \S{(U,t):t eT N ,U 7^ 0, and U C Start-cyclic N n pre N (t)} 

pre P {t) = pre N {t) 
pre P ((U, t)) = (pre N (t) -U)U {(*, s) : s G U} 

postp(t) = post N (t) 
post P ({U,t)) = post N (t) 

lp(t) = l N (t) 

lp((U,t)) = l N (t) 

Startp = (Start N — Start- cy die N ) U {(*,s) : s G Start- cy die N } 



Using this start-unwinding operator, we now define the -\- M operator on nets. 

Definition 2.2.13 Let (iV l7 Act), (N 2 ,Act) be WT Nets with disjoint sets of places and transi- 
tions and with a common alphabet, Act. Let {N[, Act) and {N 2 , Act) be start-unwind([N 1, Act)) 
and start-unwind((N 2 , Act)), respectively. Then (P,Act) = (Ni,Act) +m {N 2 ,Act) is defined 
as: 



S P = (Sn* — Start N i) l+J (S N ' — Start N i) l+J (Start N i X Start N i) 

T P = Tjv; U T N ^ 

/.a f (pre N ,(t)- Start N >)U{(s 1 ,s 2 ) e S P : s x e pre N ,(t)} if t G T N > 

Tiff ( T ) ZZ \ ■*■ ^ 

P \ (pre N fo) - Start N ,J U {(s l7 s 2 ) G SV : s 2 G pre^, (/)} if t G T^ 

P ° Stp(t) ~ \ post N ,(t) if teT N . 

1 (t-s-l M*) xteT N . 
lp W-\ i N ,(t) ifteT N , 

Startp = Start N i X Start N i 



Two other simple WT net operators play a significant role in our technical development. 
Namely, split refinements (split, a a a _A replace every a-labeled transition by two consecutive 
transitions labeled a + and a_, and choice refinements (choice( aaLaR - } ) replace every a-labeled 
transition by two conflicting transitions labeled a L and a R . Figure 2-9 gives examples of these 
kinds of refinements. 



2.2. OPERATIONS ON WELL-TERMINATING NETS 



31 



o 



o* 



o a 



o 



. a + ai, . 



o 



cr o 



(N,Act) split {a ,a+,a_)((N,Act)) choice (ataLtaR) ((N,Act}) 

Figure 2-9: Split Refinements and Choice Refinements 

Definition 2.2.14 Let {N,Act) be a WT Net, and let a,a + ,a_ G Act-{y/}. Then {P,Act) 
s P Ut (a,a + ,a-)(( N i Act )) is defined as: 

S P = S N \S {(*,*) :teT N and /^(i) = a} 

T P = {teT N : l N {t) ^ a } l±l {(i, +), (i, -) : t e T N and / N (i) = a} 



pre P ((i,+)) = 


= P re jv(0 


pre P ((t, -)) = 


= {(*,*)} 


post P {t) = 


= post N (t 


posf P ((>,+)) = 


= {(*,*)} 


postp((t,-)) = 


= post N (t 


/p(«) = 


= /*(*) 


Z P ((i,+)) = 


= a + 


*p((*,-)) = 


= a_ 


Startp = 


= Start N 



Definition 2.2.15 Let (JV, ^cf) be a WT Net, and let a, a L , a p G Act -{y/}. Then (P, ^cf) 

choice( aaLaR - } ([N , Act)) is defined as: 



T P = {i G Tat : l N {t) ^ a} l+J {(i, Z-), (i, R):teT N and /^(i) = a} 
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pre P {t) = pre N {t) 
pre P {{t,L)) = pre N {t) 
pre P {{t,R)) = pre N {t) 

post P (t) = post N (t) 
post P ((t,L)) = post N (t) 
post P ((t, R)) = post N (t) 

hit) = l N (t) 
l P ((t,L)) = a L 
l P ((t,R)) = a R 

Startp = Start N 

The following theorems show that the class of WT Nets is closed under all of the operators, 
and that we are justified in referring to the WT Net operators as "CCS/CSP-style" operators. 

Theorem 2.2.16 The class of WT Nets is closed under prefixing (a.), restriction (\a), hid- 
ing ( — a), renaming ([/]), CSP-style sequencing (;), non- communicating parallel-composition 
(||), CSP-style parallel-composition-with-synchronization (||l), CCS-style parallel-composition- 
with-hiding (|), internal choice (©), start-unwinding, CCS-style choice (+m) 5 split, and choice. 

Proof. The proof is very straightforward but tedious. As an illustration, we prove the 
case for start-unwinding; the remaining cases are left to the reader. 

Let (N,Act) be a WT Net and let (P,Act) = start-unwind((N , Act)). It is easy to see that 
all transitions in P have labels from Act U {r}, Startp is finite, and every transition in P has 
finite in-degree and out-degree. 

A straightforward inductive argument shows that if t[ . . . t' k is a run of P resulting in the 
marking M' of P then: 

• ti . . .t k is a run of N , where t\ = ti if t\ £ T N , and t\ = {U,ti) for some U otherwise. 

• The marking reached firing after t x ■ ■ -t k in N is given by the function M, where M(s) = 
M'(s) for every s G S N — Start- cy die N and M(s) = M'(s) + M'((*,s)) for every s G 
Start- cyclic. 

It is then easy to see from the definition of start-unwind that P is 1-safe, only a finite num- 
ber of transitions are enabled under any reachable marking of P, and that all places in P are 
unmarked immediately after any -^/-labeled transition fires; hence (P,Act) is a WT Net. ■ 

Except for the parallel composition operators, all of our net operations are closely related 
to the corresponding CCS/CSP operators on labeled transition systems (/fo's), cf. [7, 30]. In 
particular: 
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Theorem 2.2.17 For all the CCS/CSP WT net-operators other than ||, \\ L , and |, the Its of the 
constructed net is strongly bisimilar to the Its obtained by applying the corresponding CCS/CSP 
Its-operator to the /fs's of the component nets. Also, lts((Ni, Act)\\ L (N 2 , Act)) is strongly bisim- 
ilar to lts({N 1 ,Act))\\ Lu{ ^/ } lts({N 2 ,Act)) and lts({Ni,Act) \\ (N 2 ,Act)) is strongly bisimilar 
to lts({Ni, Act))\\ { ^dts({N 2 , Act)). Lastly, lts({Ni,Act) \ (N 2 ,Act)) is strongly bisimilar to 
lts((Ni,Act)) | lts((N 2 ,Act)), except that visible synchronization is required on -y/- actions. 

Proof. As an illustration, we prove the case for + M . The remaining cases are straightfor- 
ward but tedious and are left to the reader. 

We first prove that for all WT Nets N, the Its of (JV, Act) is strongly bisimilar to the Its of 
start-unwind({N , Act)). Let 

B = {(M,M r ) : M' is a reachable marking of start-unwind({N , Act)), 
M(s) = M'(s) for all s G Sn — Start- cy die N , 
and M(s) = M'(s) + M'((*,s)) for all s G Start- cy die N } 



Using an argument similar to that in the proof of Theorem 2.2.16, it is straightforward to 
show that B is a bisimulation between the Its of (JV, Act) and the Its of start-unwind((N , Act)). 

Let (N[,Act) and (N 2 ,Act) be start-unwind((Ni, Act)) and start-unwind((N 2 , Act)), re- 
spectively, and let 

C = {(M,M') : M' is a reachable marking of (N l ,Act) + M (N 2 ,Act) and 
M = {si G Start N i : (si,s 2 ) G M' for all s 2 G Start N >} 
U {s 2 G Start N i : (s l7 s 2 ) G M' for all Si G Start N >} 
U (M' n ((% - 5*0^-) U (S NL - Start N ,)))} 

We observe that since Start N > and Start N > have empty presets, the definition of -\- M ensures 
that firing any initial transition of N[ in (Ni, Act)+ M lts((N 2 , Act)) will disable all transitions of 
N' 2 , and vice-versa. We further observe that for any reachable marking of (Ni, Act)-\- M {N 2 , Act) 
and any Si G Start N i , if some place (s l7 s 2 ) is empty while some place (si,s 2 ) contains a token, 
then a transition of N' 2 must have fired, and vice- versa. It is then straightforward to show from 
the definition of -\- M on nets and labeled transition systems that C is a strong bisimulation 
between lts{(N[, Act)) + M lts({N^, Act)) and the Its of (N l ,Act) + M lts{(N 2 , Act)). The details 
are left to the reader. 

Since strong bisimulation is a congruence with respect to -\- M (cf. [30]), the presence of C 
together with the above fact about start-unwinding immediately implies that lts((Ni, Act)) -\- M 
lts((N 2 , Act)) is strongly bisimilar to the Its of (Ni, Act) -\- M {N 2 , Act). m 

The following propositions show that internal choice and CCS-style parallel composition 
can be "programmed" from the other operators. These propositions will be helpful in proving 
properties about the WT Net operators. 

Proposition 2.2.18 Let (Ni,Act), (N 2 ,Act) be WT Nets with disjoint sets of places and tran- 
sitions and with a common alphabet, Act. Then there is a net context C[-, ■] built from prefixing 
and CCS choice such that C[(N 1 ,Act),(N 2 ,Act)] is isomorphic to {N l ,Act) © (N 2 ,Act). 
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Proof. It is easy to show that (Ni,Act) © (N 2 ,Act) is isomorphic to the net 

(T.(N u Act))+ M (T.(N 2 ,Act)). 
The details are trivial and are left to the reader. ■ 

Proposition 2.2.19 Let (Ni,Act), (N 2 ,Act) be WT Nets with disjoint sets of places and tran- 
sitions and with a common alphabet, Act, such that Act —{y/} is closed under complementation. 
Then there is a net context C[-, ■] built from action expansion and shrinking, CSP-style parallel 
composition, choice refinements, and hiding such that C[(Ni, Act) , (N 2 , Act)] is isomorphic to 

(N u Act) | (N 2 ,Act). 

Proof. Let {a l5 <Tj", . . . , a k ,lTk} = Act — {\/}, and let Act' = {a[, a[, . . . , a' k , a' k } be distinct 
symbols not in Act. Let a and a' be the sequences of choice refinements 

a = choicer,,, „,„>)■ choice, — ,, . . . choicer a . „, „> \ ■ choice, — ,, 

\ a i: a i: a 1 ) (a^a^a'J ^ a fc) a fc) a fe J [ak,ak,a k j 

a' = choice, — ,, • choicer-^- -^- „< \ . . . choice, — ,, • choicet-^-jr- „• \ 

(ai^i^J ri) a ii a iJ (afe ,cik,a k ) \ a k,ak,a k ) 



Let 



(N[,Act") d =<r((N u Act) grow Act') 



(N' 2 ,Act") d =a'((N 2 ,Act) grow Act') 

Then it is straightforward to show that 

{N u Act) | (N 2 ,Act) = (((N[, Act")\\ Act , uW} {N^ Act"))- Act') shrink Act, 

where equality refers to net isomorphism, and —Act' is shorthand for successively hiding each 
action in Act' . The details are straightforward and are left to the reader. ■ 



Chapter 3 

Semantics of Well- Terminating Nets 



3.1 Testing Equivalence 

This chapter develops some semantics for WT Nets that are compositional for all the WT Net 
operators presented in Chapter 2 and are respectively adequate for MAY-equivalence, MUST- 
equivalence, and Testing Equivalence [19]. Some fully abstract versions of these semantics are 
then presented. 

Definition 3.1.1 A semantics, [•], assigning to any process, P, a meaning, [P], is composi- 
tional for an operator on processes if semantic equality is a congruence for the operator, i.e., 
the operator preserves semantic equality. We say that a semantics is adequate for an equiv- 
alence on processes if semantic equality implies process equivalence. Finally, we say that a 
semantics is fully abstract for a process equivalence with respect to a set of operators if the 
semantics is adequate for the equivalence and semantic equality is the coarsest congruence for 
those operators. 

We presume that the reader is familiar with the experiment-based theory of MAY-equivalence, 
MUST-equivalence, and Testing equivalence on labeled transition systems developed in [19]. In 
order to keep this thesis relatively self-contained, we repeat the basic definitions here. 

The idea behind experiment-based testing is that experimenters are given the ability to 
interact with processes in a way that affects both the process and the experimenter. In order to 
model success of an experiment, a special action uj is chosen to represent success. In this setting, 
both processes and experimenters are labeled transition systems over a common alphabet, 
except that in addition, the experimenter is allowed to independently perform the special actions 
1 and uj. Processes do not have the ability to perform either 1 or uj. Both the experimenter and 
the process must "move together" on visible actions in the common alphabet, but can move 
independently on the r action. In general, the behavior of an experimenter on a process is 
non-deterministic. 

An experiment is a sequence of possible interactions between an experimenter and a process. 
Such a sequence is a computation iff it is an interaction which cannot be extended, i.e., it is 
a maximal sequence of interactions. A computation is successful iff the experimenter passes 
through a state in which the uj action is enabled. We say that a process, p, may satisfy an 
experimenter, e, iff some interactive computation between e and p is successful. We say that a 

35 



36 CHAPTER 3. SEMANTICS OF WELL-TERMINATING NETS 

process, p, must satisfy an experimenter, e, iff every interactive computation between e and p 
is successful. 

Definition 3.1.2 Let TSi and TS 2 be labeled transition systems respectively over alphabets 
Act i, Act 2, where Act\ and Act 2 may contain the r action but do not contain the 1 or uj action. 
Let E be the set of labeled transition systems over Act\ U Act 2 U {l,u;}. Then TSi and TS 2 
are MAY- equivalent iff Act\ = Act 2 and TSi and TS 2 may satisfy the same set of experimenters 
in E. Similarly, TSi and TS 2 are MUST- equivalent iff Act\ = Act 2 and TSi and TS 2 must 
satisfy the same set of experimenters in E. TSi and TS 2 are Testing- equivalent iff they are 
both MAY-equivalent and MUST-equivalent. 

The definitions of these equivalences carry over directly to WT Nets: two WT Nets will 
be said to be MAY-equivalent, MUST-equivalent, or Testing equivalent iff their labeled transi- 
tion systems are respectively MAY-equivalent, MUST-equivalent, or Testing equivalent under the 
above definition. We assume without loss of generality that for any WT Net, (N,Act), the 
special actions 1 and uj are not in Act. 

For technical simplicity, we will work with an alternate formulation of these equivalences, 
namely, partial trace equivalence [19, 30] and failures equivalence [7, 8, 9, 21]. In order to keep 
this thesis relatively self-contained, we repeat the definitions here: 

Definition 3.1.3 Let TS be a labeled transition system, (S, ActU {r}, — ►, Si n it), where Act is 
a set of visible actions. A state s is divergent iff s can perform an infinite sequence of r-actions. 
A failure set of a state s is any set of visible actions, a, that are not enabled at s, even after 
further performing any finite sequence of r-labeled actions; that is, s j^. Then: 

traces(TS) = {d£ Act* : s^t =^} 

TiTS) = {(v,F) : v G Act*, F C Act, and there is some state s such that 
s init =^ s and F is a failure set of s} 
U {{v, F):ve V(TS) and F C Act] 

V(TS) = {v ■ v ' : v , v ' G Act* and s^t =>■ s for some divergent state s} 



For any WT Net (N, Act), we define traces((N, Act}) = f traces(lts((N, Act})), T{{N, Act)) = f 
T{lts{{N,Act))), and V({N,Act)) = f V(lts({N, Act))). 

Proposition 3.1.4 Let TSi and TS 2 be labeled transition systems respectively over finite 
alphabets Acti,Act 2 , where Act\ and Act 2 may contain the r action but do not contain the 1 
or uj action. Then 

• T^i and TS 2 are MAY-equivalent iff Act\ = Act 2 and traces(TSi) = traces(TS2). 

• TS X and TS 2 are MUST-equivalent iff Act 1 = Act 2 , ^(T^i) = T(TS 2 ) and V(TS X ) = 
V(TS 2 ). 
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• TSi and TS 2 are Testing-equivalent iff Acti = Act 2 , traces(TSi) = traces(T 'S ' 2 ) , J-(TSi) = 
T{TS 2 ) and V^S^ = V(TS 2 ). 

The proof is a straightforward generalization of that in [19] and is left to the reader. 

As shown in [19], MAY-equivalence, MUST-equivalence, and Testing-equivalence are compo- 
sitional for all the standard CCS/CSP operators on labeled transition systems. Furthermore, 
they are compositional for (the natural definition of) choice refinements on labeled transition 
systems. Similar properties hold for WT Nets: 

Proposition 3.1.5 MAY-equivalence, MUST-equivalence, and Testing-equivalence on WT Nets 
are compositional for all our CCS/CSP-style operators, choice refinements, and alphabet ex- 
pansion and shrinking. 

The proof is analogous to that of [19] and is omitted. 

Since labeled transition systems are inherently sequential, these equivalences are also com- 
positional for (the natural definition of) split refinements on labeled transition systems. A 
similar result holds for purely sequential WT Nets: 

Proposition 3.1.6 MAY-equivalence, MUST-equivalence, and Testing-equivalence are composi- 
tional for split refinements on sequential WT Nets, in which no transitions can fire concurrently 
in any reachable marking. 

Proof. Let (N,Act) be a sequentialWT Net, and let a,a + ,a_ be distinct symbols in Act. 
For any sequence v G Act* , we define split a a a _\(v) to be the sequence a x ■ ■ .ot\ v \, where each 
a j = a + .a_ if v[i] = a, and a, = v[i] otherwise. 

Firing any newly-created a + -labeled transition in split a a a _A(N,Act)) has the effect of 
"half-firing" the corresponding a-labeled transition of N, i.e., removing all the tokens from the 
preset of the a-labeled transition but not placing any tokens in its post-set. Since (N,Act) 
is a sequential net, a_ is thus the one and only action enabled in split a \((N , Act)) after 
performing any sequence of transitions that ends with an occurrence of a newly-created a + - 
labeled transition. 

It is then straightforward to show that 

traces(split ( ^((N, Act))) = 

{ s P%,a + ,a_)0) : v e traces((N,Act))}\j{split (aia+a _ ) (v)-a + : v ■ a G traces((N, Act))} 

HspK\a,a + ,aJiN,Act))) = 

{(split a a a _)(v),F') : there is some F with (v,F) G J-((N,Act)) such that 

F' C F U {a}, and if a + G F' then a G F} 
U{(spUt (ata+ta _ ) (v)-a + , F') : (v ■ a, 0) G F((N, Act)) and F' C Act -{a_}} 

U{{v,F) : v eVispUt^^JiN^Act))) and F C Act} 

^(sp^ a , a+ , a .)((N,Act))) = {split^^iv) ■ v< : v G V((N,Act)) and v< G Act*} 

The proposition is then a simple consequence of Proposition 3.1.4. ■ 

However, as is well-known, neither MAY-equivalence, MUST-equivalence, nor Testing equiv- 
alence on arbitrary WT Nets is compositional for split refinements: 
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Figure 3-1: Standard Example 

Proposition 3.1.7 ([10]) MAY-equivalence, MUST-equivalence, and Testing equivalence are 
not compositional for split refinements on arbitrary WT Nets. 

Proof. It follows easily from Definition 3.1.3 and Proposition 3.1.4 that if any two 
divergence-free WT Nets are trace inequivalentthen they are MAY-inequivalent, MU ST- inequivalent, 
and Testing- inequivalent. To prove the proposition, we repeat the example given in [10], and il- 
lustrated in Figure 3-1. It is easy to show that (JVi, Act) and (N 2 , Act) of Figure 3-1 are Testing- 
equivalent. However, split a a a _)({Ni, Act)) and split a a a _)({N 2 , Act)) are trace-inequivalent, 
since a + ba_ is a trace of split a \((Ni, Act)) but not of split aa _J(N 2 , Act)). We note 
that (Ni,Act) is not a sequential net, since the a-labeled and 6-labeled transitions can fire 
concurrently. ■ 

It is well-known that trace-inequivalent /fs's cannot be strongly bisimilar (c/. [30]). Since 
the labeled transitions systems of (Ni,Act) and (N 2 ,Act) of Figure 3-1 are strongly bisimilar, 
the same example shows that no interleaving semantics (that lies in between trace equivalence 
and strong bisimulation) can be compositional for split refinements on arbitrary WT Nets. As 
is discussed in [39, 49], it is necessary keep track of "pomsets", which generalize linear sequences 
of actions to multi-sets of actions partially ordered to reflect causality and concurrency. 

3.2 Some Compositional Semantics for WT Nets and Operators 

We begin with the standard notions of pomsets. 
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Definition 3.2.1 A pomset is a labeled partial order. Formally, a pomset, p, consists of a 
set EventSp whose elements are called events, a set Labels^ whose elements are called labels, a 
function label p : Events p ^Labels p , and a partial order relation < p on Events^. We say that p is 
a pomset over an alphabet Act iff Act contains all the labels of p. 

If p is a pomset with an empty carrier, we often simply write to denote p. If p is a pomset 
with a single event, labeled a, we often simply write a to denote p. 

We say that event e causes event e' in a pomset p iff e < p e'. The downward-closure, 
down p (e), of event e in a pomset p is {e 1 £ Events^ : e' < p e}. The downward- closure, down p (E), 
of a subset E of Events^ is _£ U (J{<io«?np(e) : e £ _E}; _£ is downward-closed iff down p (E) = E. 
We write min(p) to denote the set of events in p that are minimal with respect to < p , i.e., 
events that do not have any causes in p. We write max(p) to denote the set of events in p that 
are maximal with respect to < p , i.e., events that do not cause any event in p. We say that event 
e is a maximal cause of an event e' in pomset p iff e < p e' and there is no event e" £ Events^ 
such that e < p e" < p e' . 

The size of a pomset p, written \p\, is the size of the set Events^. A chain in p is a sequence 
of events x x x 2 ■ ■ ■ x k of p such that x x < p x 2 < p . . . < p x k . The depth of an event a; in p, written 
depth (x), is the maximum length of any chain in p of the form x x < p x 2 < p . . . < p x k < p x, for 
any events x x , ■ ■ ■ , x k . The depth of p, written depth(p), is the maximum length of any chain in 
p. 

A cut of p is any subset C of Events^ such that no two distinct events in C are causally 
related by < p . The width of p is the maximum size of any cut of p. 

A pomset p is a prefix of a pomset q iff p is a restriction of q to a downward- closed subset 
of Event s q . 

A function / is an isomorphism between pomset p and pomset q iff it is a label-preserving 
order-isomorphism, namely, 

• /: Event s p ^ Event s q is a bijection, 

• labelp = label g o /, 

• e < P e ' iff f( e ) < q f( e ') f° r ai l e ? e ' £ Events^. 

A pomset p' is a linearization of a pomset p iff it has the same events and labels as p and 
< p i is a total ordering that contains < p . For any pomset q such that < g is a total ordering and 
any 1 < i < | Event s 3 |, the i th largest event of q is the (necessarily unique) event e £ Events^ 
such that the longest chain e x < q . . . < q e k < q e in q is of length i. 

We now define the pomsets arising from WT Nets: 

Definition 3.2.2 The places of a transition t of a net N are the places directly connected to 
it, i.e., the union of the preset and postset of t. Let ti,t 2 be transitions of a net N. We say 
that ti and t 2 are statically concurrent in N iff the places of t x are disjoint from the places of 

A transition- sequence is a sequence of transitions of a net JV. For transition-sequence r = 
ti . . .t n and 1 < i < n, we write r[i] to denote the i th element, ti, of r. The transition-pomset 
of r = ti . . .t n has as events the integers from 1 to n, where the label of event i is i, and 
the partial ordering is the transitive closure of the following "proximate cause" relation: event 
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Figure 3-2: An Example of a Transition-pomset and Pomset-trace 



i proximately causes event j iff i < j and i, and ij are no£ statically concurrent in JV, c/. 
Figure 3-2. The pomset-runs of a WT Net (JV, ^4c£) are the transition-pomsets of runs of N (cf. 
Definition 2.1.1). 

If q is a transition-pomset of N , then visible(q) is the restriction of g to its events with 
visible-transition labels (cf. Definition 2.1.1); furthermore, the label of each event i is the label 
of transition l q (i) (rather than transition l q (i) itself). The pomset-traces of a WT Net (JV, Act) 
are the set of visible(q) such that q is a finite pomset run of N, cf. Figure 3-2. 

It is well known (cf. [42]) that there is a uniquely determined final marking associated with 
each finite pomset run of a net; this is the marking reached after sequentially firing the events 
of the run in any order that is consistent with its partial order. 

Proposition 3.2.3 Let r be a run of a net N, let p' be a linearization of the transition-pomset 
of r, and let r' be the transition-sequence corresponding to p' , i.e., r' = t x ■ ■ -t\ r \, where each i 8 - 
is the label of the i th largest event of p' . Then r' is a run of N reaching the same final marking 
as r. 

Proof. Let v be the sequence e x . . . e| r |, where each e, is the i th largest event of p' . Then 
it is easy to see that v is a permutation of the sequence l...|r|, and r'[i] = r[v[i]] for all 

1 < i < \r\. 

We prove the proposition by induction on the number, n, of pairs (i,j) such that i < j (as 
integers) but v[i] > v[j] (as integers). The base case of n = is trivial. 

For the induction step, let n > 1. Then there is some k such that v[k] > v[k-\-l]. Let w be v 
with the k th and k + 1 elements "swapped"; that is, w[k] = v[k-\-l], w[k-\-l] = v[k], and w and 
v agree on all other indices. Clearly, the number of pairs (i,j) such that i < j but w[i] > w[j] 
is strictly less than n. Let p" be the (totally-ordered) transition-pomset with the same labels 
and events as p' and such that for all events e,e' G Events^//, e < p n e' iff e occurs before e' in 
the sequence w. It is easy to show that p" is a linearization of the transition-pomset of r. Thus, 
by induction, the transition-sequence r" corresponding to p" is a run of N reaching the same 
final marking as r. Furthermore, it is easy to see that r"[i] = r[w[i]] for every 1 < i < \r\. 

Since p' is a linearization of the transition-pomset of r, clearly, event v[k + 1](= w[k]) must 
not cause event v[&](= w[k -\- 1]) in the transition-pomset of r, and so by Definition 6.2.1, tran- 
sition r[w[A;]] and transition r[w[A; + 1]] are statically concurrent in N . Furthermore, since r" 
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is a run of N, all places in the preset of transition r[w[A; + 1]] must be marked after the run 
r[w[l]] . . .r[w[A;]]. The definition of static concurrency implies that no firing of transition r[w[A;]] 
can add any tokens to the preset of transition r[w[£; + l]]; thus, transition r[w[£; + l]] must be en- 
abled after the run ?"[w[l]] . . .r[w[k — 1]] as well. Conversely, all places in the preset of transition 
r[w[A;]] must be marked after the run ?"[w[l]] . . .r[w[k— 1]]. The definition of static concurrency 
implies that no firing of transition r[w[A; + 1]] can remove any tokens from the preset of r[w[A;]]; 
thus, r[w[A;]] must be enabled after the run ?"[w[l]] . . . r[w[£; — l]]r[w[A; + 1]] as well. It then 
follows easily that ?"[w[l]] . . .r[w[A; — l]]r[w[A; + l]]?"[w[A;]] is a run of N reaching the same final 
marking as the run f[u;[l]] • • .r[w[k — l]]r[w[k]]r[w[k-\-l]],fiom which the lemma follows easily. ■ 

Our definition of "pomset-failures" is a natural generalization of (sequential) "failures" in 
that it associates "failure sets" to finite pomsets. 

Definition 3.2.4 A pomset-failure is a pair (p, F), where p is a finite pomset, and F is a finite 
set of labels. We say that {p,F) is a pomset-failure over an alphabet Act iff Act contains all 
the labels of p and F C Act. 

We define a "failure set" of a marking as any set of visible actions that are not enabled under 
that final marking, even after further firing any finite sequence of r-labeled transitions. This is 
exactly the standard definition of "failure sets" of states of the labeled transition system of the 
net (c/. Definition 3.1.3). Using Proposition 3.2.3, we can unambiguously refer to the marking 
of a net reached after a pomset-run. 

Definition 3.2.5 The pomset-failures of a WT Net (N,Act) are the pairs (visible(q) , F) such 
that q is a finite pomset run of N and F C Act is a failure set of the marking after q. 

We also wish to define a notion of "pomset-divergences" that is a natural generalization of 
(sequential) "divergences." 

Definition 3.2.6 A pomset-divergence is a pair (p,D), where p is a finite pomset and D is a 
non-empty set of downward- closed subsets of Events^. We say that (p, D) is a pomset-divergence 
over an alphabet Act iff Act contains all the labels of p. 

Given any pomset run with only a finite number of visible events, it is easy to see that any 
infinite chain of r-labeled-events indicates a divergence of the net. We wish to define pomset- 
divergences of nets in such a way that we keep track of all the concurrent divergences within a 
pomset run while abstracting away from the r-labeled events. 

Definition 3.2.7 Let q be an infinite pomset run of a WT Net (N,Act) with a finite number 
of visible events. Let V be the family of sets of the form (events of) visible(down q (C)) such 
that C is an infinite chain of r-labeled events of q. Then (visible(q),V) is a pomset-divergence 
of (N, Act), cf. Figure 3-3. 

It turns out that the semantics defined by simply taking these pomset-failures and pomset- 
divergences makes too many distinctions between nets, and we need to "blur" certain kinds of 
information from our runs. This we accomplish through various closure operations. The first 
such closure involves taking "augmentations" of our pomset-failures and pomset-divergences. 
We first restate the standard definition for pomsets, where an augmentation is simply an increase 
in the partial ordering. 
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Figure 3-3: An Example of a Pomset Divergence (p, -D) 

Definition 3.2.8 Pomset p' is an augmentation of pomset p iff p and p' have the same set 
of events with the same labels, and the partial ordering of p' contains the partial ordering of 
p. Let augment(p) be the set of augmentations of p. The augmentations, augment ( (p, F)), 
of a pomset-failure {p,F) is the set {(p',F) \ p' £ augment(p)}. For pomset-divergences, let 
augment ((p,V)) be 

{(p',V) : p' £ augment(p) and V = {down p >(d) : d £ D}} 

We write p' y p iff p' is an augmentation of p, and write (p', _D') ^ (p, _D) iff (p', _D') is an 
augmentation of (p, D). 

Our other closure operation arises from the fact that MUST-experiments fail to yield in- 
formation about the behavior of a net after a divergence. To get around this difficulty, we 
define below the notion of an extension of a pomset-divergence; the idea is that the extension 
is another pomset-divergence which may contain more information concerning events and di- 
vergences which "happen after" one or more divergences in the original pomset-divergence. All 
the information about a process after a pomset-divergence is blurred by throwing in all possible 
pomset-failures and pomset-divergences which extend the original pomset-divergence. 

Definition 3.2.9 Pomset-divergence (p',V) extends pomset-divergence (p,V), 
written (p,£>)C(p',£>'), iff 

p is a prefix of p' 

for all e G p' — p, there is some d £ V with d C down p >(e); and 

for all d 1 G V , there is some d £ V with d C d 1 . 

For any alphabet Act which contains all the labels in pomset p, let extend A c t({p,F>)) be the 
set of pomset-divergences over Act which extend (p,D). Finally, let 

implied- failures Art ((p,V)) = {(p,F) : F C Act}. 
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We lift these operations on individual pomsets, failures, etc., to sets of individuals by point- 
wise union. For example, 

augment(X) = M augment(x). 
xex 

We are now ready to define the pomset versions of the MAY-, MUST-, and Testing- semantics. 
Definition 3.2.10 For any WT Net (N,Act), 

{{N, Act)j MAY = f {augment(pomset-traces({N, Act))), Act) 

Div((N, Act)) = augment( extend Act{pomset-divergences([N , Act)))), 

Fail((N,Act)) = augment(pomset-failures((N,Act)))U impUed-failures Art (Div((N , Act))), 

l(N, Act)} MVST d = (Fail((N, Act)), Div((N, Act)), Act), 
l(N, Act)}™ ST d ^ (l(N, Act)r A \ l(N, Act)r vsT ). 



Our definition of semantical equality implicitly equates label-preserving order-isomorphic 
pomsets. 

We observe that: 

Proposition 3.2.11 For any WT Net (N, Act), if {{N, Act)j MAY = {PT, Act) and {{N, Act)j MlJST 
= (PF,PD,Act), then PT is a set of pomset-traces over Act, PF is a set of pomset-failures 
over Act, and PD is a set of pomset-divergences over Act. 

The proof is trivial and is left to the reader. 

Theorem 3.2.12 [-] MAY , [.] MUST , and [-] TEST on WT Nets are respectively adequate for MAY- 
equivalence, MUST-equivalence, and Testing- equivalence. 

Proof. There is an obvious correspondence between sequences of actions and linearly- 
ordered pomsets, which we implicitly use in the equalities below. Since the [-] MAY and |.J MUST 
semantics are augmentation- closed, it is straightforward to show that for any WT Net (JV, Act), 

traces((N , Act)) = {v G fst({{N,Act)j MAY ) : v is linearly ordered} 

T{{N,Act)) = {(v,F) : v is linearly ordered and (v,F) G fst({(N, Act)j MVST )} 
V((N,Act)) = {v. v is linearly ordered and (v,D) G snd(l(N, Act)} MlJST ) for some D} 
Act = snd(l(N,Act)} MAY ) = third{\(N , Act)} MlJST ) 

from which the theorem follows directly. ■ 

The following closure properties of the semantics will be useful in proving compositionality. 
We extend the definition of prefixes to pomset-divergences: 
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Definition 3.2.13 Let (p,D p ),(q,D q ) be pomset-divergences. Then (p,D p ) is a prefix of 
(q,D q ) iff p is a prefix of q and D p C D q . 

Proposition 3.2.14 Let (N,Act) be a WT Net. Then pomset-traces((N , Act)) is a prefix- 
closed set of pomset-traces and and pomset-divergences((N , ^4c£)) is a prefix-closed set of pomset- 
divergences. Furthermore, for any pomset-failure (p, _F) and prefix g of p, if (p, _F) is a pomset- 
failure of N, then so is (g, 0). 

Proof. The proposition is easily proved from the definitions of pomset-traces, pomset- 
failures, and pomset-divergences of nets. ■ 



Proposition 3.2.15 Let (p,D p ), (q,D q ), and (r,D r ) be pomset-divergences with (p,D p ) Q 
(<liD q ) ■< (r,D r ). Then there is some (p',D p i) Q (r,D r ) such that (p',D p i) is an augmentation 
of a prefix of (p, D p ). 

Proof. Let p' be the restriction of r to the set {e G Events^ : down r (e) C p}, and let 
D p i = {down p i(d) : d G D p and d C p'}. The remainder of the proof is straightforward and is 
left to the reader. ■ 



Proposition 3.2.16 Let (p,D p ), (q,D q ), and (r,D r ) be pomset-divergences with (p,D p ) ^ 
(<liD q ) Q (r,D r ). Then there is some (q',D q i) ^ (r,D r ) such that (q',D q i) extends (p,D p ). 

Proof. Let q' have the same events and same labels as r, and let D q i = D r . Furthermore, 
define < q i as x < q i y iff x G Events^ and x < r y. The remainder of the proof is straightforward 
and is left to the reader. ■ 



Proposition 3.2.17 Let p, q, q 1 be pomsets such that p < q and q' is a prefix of q. Then there 
is some p' ^ g' such that p' is a prefix of p. 

Let (p, D p ) , (q, D q ) , (q' , D q i) be pomset-divergences such that (p,D p ) ■< (q,D q ) and (q',D q i) 
is a prefix of (q,D q ). Then there is some (p',D p >) ■< (q',D q >) such that (p',D p >) is a prefix of 

Let (p, D p ) , (q, D q ) , (q' , D q i) be pomset-divergences such that (p,D p ) C (q,D q ) and (q',D q i) 
is a prefix of (q,D q ). Then there is some (p',D p >) C (q',D q i) such that (p',D p >) is a prefix of 

Proof. Let p' be the restriction of p to Events^/ and, for the second and third parts, let 
_D p , = {d £ Dp : d C Events^}. The remainder of the proof is straightforward and is left to the 
reader. ■ 



Proposition 3.2.18 Let {N,Act) be a WT Net. Then Fail{(N ', Act)) is an augmentation- 
closed set of pomset-failures and Div((N,Act)) is an augmentation- closed and extension-closed 
set of pomset-divergences. 
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Proof. It is easy to see from Definition 3.2.10 and the definition of implied-failures that 
that both sets are augmentation-closed. The extension-closure of Div((N,Act)) is a simple 
consequence of Proposition 3.2.16. ■ 

The following operations on pomsets and pomset-divergences correspond to our operators 
on WT Nets and will be useful in proving compositionality of our semantics. 

Definition 3.2.19 Let p be a pomset and a a label. We define p with a to be the set of pomsets 
p' such that p is a prefix of p', there is exactly one event in p' — p, and this event is a-labeled. 

Definition 3.2.20 Let p be a pomset and let X be a set of maximal events in p. Then p — X 
is p restricted to Events^ — X . 

Definition 3.2.21 Let p be a pomset, {p,D) a pomset-divergence, and a a label. We define 
a.p to be the pomset with Event s a . p = Events^ U {e a } for some e a G - Events^, / a . p (e a ) = a 

and l ap agrees with l p on Events^, and < ap = < p U ({e a } X Events^). Furthermore, a.(p,D) = 
{a.p,{dU {e a } : d G D}). 

Definition 3.2.22 Let p be a pomset, {p,D) a pomset-divergence, and a a label. We define 
p— a to be p restricted to its events that are not a-labeled, and 
(p, D)— a = (p— a, {d n Events^ a : d G D}). 

Definition 3.2.23 Let p be a pomset, (p, D) a pomset-divergence, and / a function from labels 
to labels whose domain contains all the labels in p. Then p[f] has the same events as p with 

the same ordering, but l p ^ = f o l p . Furthermore, (p,D)[f] = (p[f],D). 

Definition 3.2.24 Let p and q be pomsets with disjoint sets of events. We define p; q to be 
the pomset such that Events p;g = Events^ U Events^, l p . q agrees with l p on Events^ and agrees 
with l q on Events^, and < P]q = < p U < q U (Events^ X Events^). 

Definition 3.2.25 Let p be a pomset, {p,D) a pomset-divergence, and a,a L ,a R labels. Then 
choice( aaLaR - } (p) is the set of pomsets q with the same events and same ordering as p and such 
that l q agrees with l p on all non-a-labeled events of p, and l q {x) = a L or l q {x) = a R for all 
a-labeled events x of p. Furthermore, 

choice (ataLtaR) ({p,D}) = {{q,D} : q G choice (ataLtaR) (p)}. 

Definition 3.2.26 Let p be a pomset, a,a + ,a_ be labels, and H C {x £ max(p) : l p {x) = a}. 
Then split a a a _ H \(p) is defined to be the pomset q with all a-labeled events in H "half-split" 
and ah other a-labeled events "fully split," i.e., 

• Events, = {(y, 0) G Events p : l p (y) ^ a} U {(y, 1) : y G H } 
U {(y, 1), (y, 2):ye Events^ - H and l p (y) = a}. 

• For all (y,i) G Events,, l q ((y,l)) = a+, l q ((y,2)) = a_, and l q ((y,0)) = l p (y). 

• For all (x,i),(y,j) G Events,, (x,i) < q (y,j) iff either x < q y or (x = p y and i < j). 
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We then define: 

S P Ut (a,a + ,a.)(P) = { S P Ut (a,a + ,a. ,H)(P) '■ H C { X £ max(p) l l p (x) = Cl}} 

Our definition of H^ on pomsets generaiizes that of [8, 21] on sequences of actions. In 
particular, we are careful to prohibit synchronizations between pairs of actions that introduce 
too many ordering constraints and hence violate anti-symmetry of the partial orders. 

Definition 3.2.27 Let A be a finite alphabet, let p and q be pomsets with disjoint sets of 
events, and let D p and D q be downward- closed subsets of Events^ and Events^, respectively, such 
that D p U D q j^ 0. For any bijection / from {e £ Events^ : l p (e) £ A} to {e' £ Events^ : l q (e') £ 
A} such that 

• / is label-preserving, i.e., l p (e) = l q (f(e)) for all e £ Events^ with l p (e) £ A, and 

• / is order-non-contradicting, i.e., 

— The transitive-closure of < p U{(e, e') £ Events^ X Events^ : /(e) < q f(e')} is a partial 
ordering; in particular, it is anti-symmetric. 

— The transitive-closure of < q U {(/(e), f(e')) £ Events^ X Event s q : e < p e'} is a partial 
ordering; in particular, it is anti-symmetric. 

we define r = p\\ A q as: 

• Events,, = {(e, *) : e £ Events^ and l p (e) £" A} U {(*,e') : e' £ Events,, and l q (e') £" A} U 
{(e,/(e)) : e £ Events^ and l p (e) £ A}. 

• / r (e,*) = l p (e), / r (*,e') = l q (e'), and / r (e,/(e)) = / p (e). 

• ( s ? 2/) <r (^'j 2/') iff either x < p x' or y < q y' . 

We define (p, D p )\\ A (q, D q ) = (r,D r ), where r = p\\ A q and 

_D r = {down r (E) : E = {z £ Events r : fst(z) £ d} for some d £ D p } 

U {down r (E') : E' = {z £ Events,, : snd(z) £ d'} for some d! £ D q } 

We define 

p\\ A q = {p||^: / is a label-preserving, ordering-non-contradicting bijection from 
{e £ Events^ : l p (e) £ A} to {e' £ Events,, : l q (e') £ A}} 

and 

(p, D p )\\ A (q, D q ) = {(p, D p )\\ A (q, D q ) : /is a label-preserving, ordering-non-contradicting 

bijection from {e £ Events^ : / p (e) £ A} 
to {e' £ Events,, : l q (e') £ A}} 
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It is easy to show that pomsets and pomset-divergences are closed under ah the above 
operations; the details are left to the reader. 

We now define corresponding operations on sets of pomset-traces, pomset-failures, and 
pomset-divergences. We will use these definitions heavily in proving the compositionality of 
our semantics with respect to the WT Net operators. 



Definition 3.2.28 Let Act be a finite alphabet containing the distinguished symbol y/ and let 
PT be a set of pomset-traces over Act. Let a,a L ,a R ,a + ,a_ £ Act— {y/}, let A be a subset of 
Act containing y/, let /be a function from Act to Act such that for ah a £ Act, f(ot) = y/ iff 
a = y/, and let Act' be a finite set of labels containing y/. Then: 



{PT, Act) grow Act' d = {PT, Act U Act'} 
{PT, Act} shrink Act = {{p £ PT : all events in p have labels in Act }, Act } 
a.{PT, Act} d = ({0} U {a.p : p £ PT}, Act} 

def 

{PT, Act}\a = {{p £ PT : p has no a-labeled event}, Act} 
{PT,Act}[f} d ^{{p[f]:pePT},Act} 
{PT, Act}- a d = {{p- a : p E PT},Act} 

def 

{PTij Act); (-PT2, Act) = {{p E PT\ : p does not contain a ^/-labeled event} 

U{(pi;p 2 ): (pi;V)£PTi &ndp 2 ePT 2 },Act} 

def 

(PT lt Act) 8 {PT 2 ,Act} = {P^ U PT 2 , Ac*) 

{PT u Act} + M {PT 2 ,Act} = {PTi U PT 2 , Act} 

(PTuAcQWAiP^Act) A = {augment{[j{p l \\ A p 2 : Pl £ PT u p 2 £ PT 2 }), Act} 
{PT u Act} || (PT 2 , Ac*} d = {augment({J{ Pl \\ w}P2 : Pl £ PT u p 2 £ PT 2 }), Ac*} 
s P lli (a,a + ,a.)({ PT , Aci )) = {augment(U{spUt (aa+ta _ ) (p):p<E PT}),Act} 

choice (a)aL)aR) ({PT,Act}) = ( |J{c/jo«ce( a)aL)aR )(p) : p £ PT}, Act} 
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{PT l ,Act)\{PT 2 ,Act) d = 

{(a({PTi,Act) grow Act')\\ Act , uW} a'((PT 2 , Act) grow Act'))- Act') shrink Act 
where {a lt aT, . . . , a k , a£} = Act-{^/}, 

Act = {a' 1; a[, . . . , a' k , a' k } are distinct symbols not in Act, 
a is the sequence choice/,,, ,,, ,,t\ ■ choice, — r, ... choicer n , „, „i\- choice, —r+, 

~i (ai,ai,a 1 ) (01,01,0'J r'i"'f"jJ (a k ,a k ,a' k )' 

and a' is the sequence choice, — s • choicetjmrr „' \ ■ ■ ■ choice, —. ■ choicetjrr ttt ,,' \ 

n (([1,01,0^ \^i,^i > ^ 1 } [ak,ak,a k j \ a k,^k,^ k } 



Definition 3.2.29 Let Act be a finite alphabet containing the distinguished symbol ^/, let 
PF,PFi,PF 2 be sets of pomset-failures over Act, and let PD,PDi,PD 2 be sets of pomset- 
divergences over Act. Let a,a L ,a R ,a + ,a_ £ Act— {\/}, let A be a subset of ,4c* containing ^/, 
let / be a function from ,4c* to Act such that for all a £ ,4c*, /(a) = \J iff a = ^/, and let Act' 
be a finite set of labels containing yj . 

Then: 

(PF,PD, Act) grow Act' = f (i^', PD', Act U ,4c*') 
where 

PF' = {{p, F I) X) : X C Act- Act and (p,F) e PF} 

U implied- f allures Act uAct'iJ 1 '^') 
PD' = augment(extend Aci uAci i(PD)) 



{PF,PD, Act) shrink Act' = f {PF' , PD' ,Act'} 

where 
_P_F' = {(p, F) £ _P_F: all events in p have labels in Act and F C Act } 
_PD' = {(p, D) £ P£) : all events in p have labels in Act } 



a.{PF,PD,Act) = f (PF',PD',Act) 
where 
PF' = {(0,F): PC ,4c*-{a}}U{(a.p,F): (p,F) ePF} 
PD' = {a.(p,J}):(p,fl)ePfl} 



(PF,PD,Act)\a = f (PF',PD',Act) 
where 
PF 7 = {(p, F) : p has no a-labeled event and (p, F — {a}} £ PF} 

U implied- f allures Act (P D') 
PD' = augment(extend Aci ({(p,D) £ PD : p has no a-labeled event})) 
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(PF,PD,Act)[f] = (PF',PD',Act) 
where 
PF' = {(p[f],F): F C Act and (p, {be Act: f(b) = a for some a e F}) e PF} 

U implied- f allures Act ( P D') 
PD' = augment(extend Act ({(p,D)[f]: (p,D) e PD})) 

(PF, PD, Act}- a = (PF', PD', Act) 

where 
PP' = {(p- a, F) : (p, F U {a}} £ _P_F} U implied- f allures Act (PD') 
PD 1 = augment(extend Act ({{p,Dl)D p }- a: (p,D) e PDUPF, 

(p, D U Dp) is a pomset-divergence, 

and for all n > 0, there is some p n with (p„, D) £ PD U -P-F 1 

such that 

(p, Dp) C. (p n , {Events Pre }}, all events in p n — p are a-labeled, 

and for every d £ D p , 

there is some n-length chain of a-labeled events in p n — p 

whose downward closure restricted to p is d})) 



choice (ataLtaR) ({PF, PD, Act)) = {PF', PD', Act) 

where 
PF' = {(q, F q ) : there is some (p, F p ) £ PF such that q £ choicer a ,a L ,a R )(p), F q C F p U {a}, 
and if a^ £ P g or a^ £ F q then a £ F p } 
U implied-f allures Aci (P D') 

PD' = augment(extend Art (\J{choice (aiaLiaR) ((p,D)): (p,D) e PD})) 

(PP 1; PP>!, Aci) 8 (^2, PP>2, Ac*) = (PF! U PF 2 , FDi U PD 2 , Act) 

(PF 1 ,PD 1 , Act); (PF 2 , PD 2 , Act) = (PP', PD', ,4c*} 

where 
PP' = {(p, F) : (p, F U {-*/}} £ PPi and p does not contain a -^/-labeled event} 

U {(pi;p 2 , F) : ( Pl ; Ij , 0} £ PF X and (p 2 , F) £ PF 2 } U implied- f allures Act (PD') 
PD' = PD l Vj{(p l ;p 2 ,{dVJVvents Pl : deD):( Pl ; ^,$)ePF l and (p 2 ,D) ePD 2 ) 

(PFuPDi, Act)\\ A (PF 2 , PD 2 , Act) = (PF', PD', Act) 

where 
PF' = augment({(p, F) : there are some (p\, F\) £ PF\, (p 2 , F 2 ) £ PF 2 such that p £ Pi||aP2, 

F - AC FiC\F 2 and F C\AC FiU F 2 }) 
U implied- f allures Act ( P D') 

PD' = augment(extend Act ({J{( Pl , D^Wa^, D 2 ) : (pi,£>i) e PD^ PF U (p 2 , D 2 ) ePD 2 UPF 2 , 

D\ and Z?2 are (possibly empty) downward-closed subsets of 
Events Pl and Events P2 , respectively, and D\ U D 2 ^ 0})) 
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(PFi, P£>i, Act) || (PF 2 , PD 2 , Act) = (PF^PDi, Act)\\ W] {PF 2 , PD 2 , Act) 

(PFuPD^Act) | (PF 2 ,PD 2 ,Act) = 

{(a({PFi,PDi,Act) grow Act')\\ Act , uW} a'((PF 2 ,PD 2 , Act) grow Act'))- Act') shrink Act 
where {01,0^. . . ,a fc ,a£} = Act-{y/}, 

Act = {a' 1; a[, . . . , a' k , a' k } are distinct symbols not in Act, 
a is the sequence choicer n , „, „m • choice, — s . . . choicer „, „, „m • choice, — s, 

^ ^ai,ai,a 1/ l (a^a^a'J V a fe) a fe) a fe^ [ak,ak,a k )> 

and c' is the sequence choice, —r. ■ choicetjmrr n 1 \ ■ ■ ■ choice, —r+ ■ choicetjrr ttt n ' \ 

^ (ai,ai,iij) l."i ,"i >«! J (a k ,a k ,a' k ) \ a k,ak,a k j 

Theorem 3.2.30 [-] MAY is compositional for split refinements, choice refinements, alphabet 
expansion and shrinking, and all of our CCS/CSP operators. 

Proof. Let Act be a finite alphabet containing y/, let a,a L ,a R ,a + ,a_ £ Act — {y/}, let 
A C Act, let / be a function from Act to Act such that for all a £ Act, /(a) = y/ iff a = y/, and 
let Act' be a finite set of labels containing y/. Furthermore, let (JV, Act), (JVi, ^4c£), (JV 2 , ^4c£) be 
WT Nets. 

It is straightforward but tedious to show that the following identities hold, where the op- 
erations on the right-hand side of the equations are those defined in Definition 3.2.28. As an 
illustration, we will prove the equality for prefixing; the details of the other cases are left to the 
reader. 



l(N,Act) grow Act'} MAY = l(N,Act)} MAY grow Act' 
[(N,Act) shrink Act'] MAY = {(N,Act)] MAY shrink Act' 
la.(N,Act)} MAY = a.l(N,Act)} MAY 
lT.(N,Act)} MAY = l(N,Act)} MAY 
l{N,Act)\ar AY = {{N,Act)r AY \a 
l{N,Act)[fT AY = l{N,Act)r AY [f] 
l(N, Act) - a} MAY = l(N, Act)} MAY - a 
{(N^Acty^N^Act)}^ = KN^Act^aiN^Act)}™* 
l(N u Act) © (N 2 , Act)] MAY = l(N u Act)] MAY © l(N 2 , Act)f 
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l(N u Act) + M (N 2 ,Act)] MAY = KN^Act)}™ + M {(N 2 , Act)] MAY 
l(N u Act) || (N 2 ,Act)] MAY = KN^Act)}^ \\ {(N 2 , Act)] MAY 
{(N^Act^UiN^Act)}^ = {(NuAct^niAuwyK^Act)}^ 
{(N^Act) | (N 2 ,Act)] MAY = KN^Act)}™ \ {(N 2 , Act)] MAY 

lchoice (ataLtaR) ((N,Act))} MAY = choice (ataLtaR) (l(N,Act)} MAY ) 

[^a,a + ,a_)«^^Ci»] MAY = ^ a , a+ , a _ ) ( [(N , Act)]™ ) 

To prove the equality for prefixing, we first make without proof the easy observation that 

pomset-traces(a.(N , Act)) = fst(a.(pomset-traces((N , Act)), Act)). 

For one direction of the desired equality above, let q £ {a.(N , Act)J MAY ; then, from the above 
fact, the definition of [-] MAY , and Definition 3.2.28, it is easy to see that either q = or q y a.p 
for some pomset-trace p of (N,Act). It follows from general properties of pomsets that either 
q = or q = a.q' for some q' y p, from which it follows immediately that q £ a.l(N,Act)J MAY . 
For the other direction, let r £ a.{(N, ^4c^)] MAY ; then either r = or r = a.p for some p that is 
an augmentation of some pomset-trace p' of (JV, Act). If r is non-empty, it follows from general 
properties of pomsets that r y a.p'. Using the definition of [-] MAY and the highlighted fact 
above, it is then easy to see that r £ {a.(N , Act)J MAY , proving this case. 

Proposition 2.2.19 and the above equalities for alphabet expansion and shrinking, CSP-style 
parallel composition, choice refinements, and hiding together immediately imply the composi- 
tionality of CCS-style parallel composition. ■ 

The following proposition will be helpful in our proof of compositionality for the [.] MUST 
semantics: 

Proposition 3.2.31 Let Act be a set of labels, let (qi,D qi ) £ augment(extendA c t({Pi,D Pl ))), 
let (q 2 ,D q2 ) £ augment ( extend Act ({p 2 , D P2 ))), and let (q,D q ) £ (q l ,D qi )\\ A (q 2 ,D q2 ). Then there 
are some prefixes (p[,D p '),(p' 2 ,D p ') of (pi,D Pl ),(p 2 ,D P2 ), respectively, such that (q,D q ) £ 
augment(extend Ac t((p' 1 , Dp'JWAiti, D p >))). 

Proof. By definition, (q,D q ) = (qi, D qi )\\ A (q 2 , D q2 ) for some label-preserving, order- 
non-contradicting bijection / from {e £ Events gi : l qi (e) £ A} to {e 1 £ Events g2 : l q2 (e') £ A}. 
Let /' be / restricted to Events Pl X Events P2 . Let p[ be the prefix of p x with carrier {x £ 
Events Pl : for all y £ Event s Pl , if y < Pl x and l Pl (y) £ A then f(y) £ Events P2 }, and let D p > = 
{d £ D Pl : d C p[}. Similarly, let p 2 be the prefix of p 2 with carrier {x £ Events P2 : for all y £ 
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Events P2 , if y < P2 x and l P2 {y) G A then / 1 (y) G Events Pl }, and let D p > = {d G D P2 : d C p' 2 }. 

It is straightforward but tedious to show that (q, _D g ) G augment(extendA c t((p'n Dp 1 )\\a (P25 -^V )))> 
the details are left to the reader. ■ 



Theorem 3.2.32 |.J MUST an d [•] TEST are compositional for all the WT Net operators, except 
for split refinements and the CCS choice operator, Am- 

Proof. Let Act be a finite alphabet containing y/, let a, a L , a R , a + ,a_ G Act, let A C Act, 
let / be a function from Act to ^4c£ such that for all a G Act, f(ot) = y/ iff a = y/, and let Act' 
be a finite set of labels containing y/. Furthermore, let (N , Act) , (Ni, Act) , (N 2 , Act) be WT 
Nets. 

It is straightforward but tedious to show that the following identities hold, where the oper- 
ations on the right-hand side of the equations are those defined in Definition 3.2.29. We prove 
the equalities for CSP-style parallel composition and hiding; the details of the remaining cases 
are left to the reader. 

l(N,Act) grow Act'} MlJST = {(N, Act)} MlJST grow Act' 

l(N, Act) shrink Act'} MlJST = {(N, Act)} MlJST shrink Act' 

la.(N,Act)} MVST = a.l(N,Act)} MVST 

lT.(N,Act)} MVST = l(N,Act)} MVST 

l(N,Act)\a} MVST = l(N,Act)} MVST \a 

l(N,Act)[f}} MVST = l(N,Act)} MVST [f} 
l(N, Act)- a] MUST = l(N, Act)J MVST - a 
UN,, Act); (N 2 ,Act)} MlJST = [<# 1; Act)} MlJST ; {(N 2 , Act)} MlJST 
l{N u Act) 8 {N 2 ,Act)J MVST = {{N u Act)J MVST ® {{N 2 , Act)J MVST 
UN,, Act) || (N 2 ,Act)} MlJST = {(N^Act)}^ || [(N 2 , Act)} MlJST 

p^, Ac*)|| A (Ar 2 , Ac*)] MUST = [(^i^^)] MUST |UuV}[(^2^rf}] MUST 
UN,, Act) I (N 2 ,Act)} MlJST = {(N^Act)}^ | [(N 2 , Act)} MlJST 
lchoice (aiaLiaR) ((N, Act))} MJ]ST = choice (aiaLiaR) (l(N, Act)} MJ]ST ) 
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To prove the equality for CSP-style parallel composition, we first state without proof the 
easily proved fact that: 

pomset- failures((Ni, Act)\\A(N2, Act}) = 

{(p, F) : there are some (p\, F\) £ pomset-failures((Ni, Act}), (j>2, F2) £ pomset-failures((N2, Act}) 
such that p £ P i\\auW}P2, F-(AU W}) CF l C\F 2 and Fn(AU W}) C F l U F 2 } 

pomset- divergences((Ni, Act)\\A(N2, Act}) = 

U{(Pi; F>i}\\au{^}(P2, D2) '■ (pi, D\) £ pomset- divergences ((Ni, Act}) U pomset- failures((Ni, Act)), 

(P2, D2} £ pomset-divergences((N2, Act}) U pomset-failures((N2, Act}), 
D\ and D2 are (possibly empty) downward-closed subsets of 
Events Pl and Events P2 , respectively, and D\ U D2 7^ 0})) 



For one direction of the desired equality, let (r,D r ) £ snd([(iVi, Act)\\ A (N 2 , Act)j MlJST ); then 
(r,D r ) £ augment (extend Act ({p, Dp))) for some pomset-divergence (p, _D p ) of (iVi, ^4ci)|| > i(iV"2, Act). 
It then follows easily from the highlighted fact above, the definition of |.J MUST 5 an d Defini- 
tion 3.2.29 that (r,D r ) £ l(N u Act)] MVST \\ A uW}l(N2, Act)] MVST . The proof for pomset-failures 
is very similar and omitted. For the other direction, let 

{r,D r ) £ snda(N 1 ,Act)} MVST \\A U{ V}l(N2,Act)r vsT y, 

then (r, D r ) £ augment( extend Ac t({q, D q ))) for some pomset-divergence (q, D q ) such that (q, D q ) 
e ( qi ,D qi )\\ Au{V} (q 2 ,D q3 ) for some (q u D qi ) £ l(N u Act)} M ™ and (q 2 ,D q2 ) £ [(JV 2 , ^)] MUST - 
In turn, (qi,D qi ) £ augment( extend Aci ((pi,D Pt ))) for some (pi,D Pl ) and (p 2 ,D P2 ) that are 
pomset-divergences/pomset-failures of iVi and iV 2 respectively. Now, Proposition 3.2.31 implies 
that there are prefixes (p[, D p > ), (p' 2 , D p > ) of (p l7 -D Pl ), (p 25 F) p2 ) respectively such that (q, D q ) £ 
augment(extend Ac i{(p\,D pli )\\ Au{ ^(p' 2 ,D pl2 ))). By Proposition 3.2.14, (p' l7 D^), (p' 2 , D^) are 
pomset-divergences/pomset-failures of Ni,N 2 , hence the highlighted fact above together with 
the definition of [.] MUST implies that (q,D q ) £ snd([(JVi, Act)\\ A (N 2 , Act)j MVST . It now follows 
from Proposition 3.2.18 that (r,D r ) £ sndiKN^ Act)\\ A (N2, Act)} MVST . The proof for pomset- 
failures in fst(l(N u Act)j MVST \\ A uW}l( N 2, Act)j MVST ) then follows easily from the highlighted 
fact above; we omit the details. 

We now prove the equality for hiding. Since the definition of failure sets "looks through" 
firings of r-transitions and failure sets are closed under subsets, it is straightforward to show 
that 

pomset-failures((N, Act)— a) = {(p— a, F) : (p, F U {a}} £ pomset-failures((N, Act})} 



We recall that by definition of WT Nets, only a finite number of transitions are enabled 
under any reachable marking. Thus, it is possible for unbounded-length sequences of a-labeled 
events to be enabled after any prefix d of a pomset p only if either a divergence is enabled 
immediately after d or a divergence is enabled "along the way to d," i.e., immediately after 
some pomset d' with (d', {Events^/}) C (d, {Events^}). In either case, it then follows easily from 
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the definition of pomset-divergences that: 
extend A ci (pomset-divergences((N , Act)— a))) 

extend Ad({{p, D U D p } — a : (p, D) £ pomset-divergences((N, Act}) U pomset-failures((N , Act}), 

D U Dp ^ 0, (p, D U Dp} is a pomset-divergence, 
and for all n > 0, there is some p n with 

(p n , D) £ pomset-divergences((N, Act})) U pomset-failures((N , Act})) 
such that 

(p, -Dp) IZ (p n , {Events Pre }}, all events in p n — p are a-labeled, 
and for every d £ D p , 

there is some n-length chain of a-labeled events in p n — p 
whose downward closure restricted to p is d}) 

To prove one direction of the desired equality, let (r,D r ) £ snd(l(N , act) — a] MUST ); then 
(r,D r ) £ augment( extend Ad{{p, D v ))) for some pomset-divergence (p,D p ) of (N,Act) — a. 
It then follows easily from the highlighted fact above, the definition of [-] MUST , and Defini- 
tion 3.2.29 that (r,D r ) £ snd(l(N,act)} MVST - a). The proof for pomset-failures (r,F r ) £ 
fst(l(N , act) — a] MUST ) is very similar and is omitted. 

For the other direction, let (PF,PD,Act) = {(N, Act)j MlJST and let (r,D r ) 

£ snd({{N ', Act)j MlJST - a). Then by Definition 3.2.29, {r,D r ) £ augment(extend Act ({p, D U 

Dp) — a)) for some pomset-divergence (p,D U _D P ) and some sequence ((p n ,D) : ra > 0) such 

that 

{p,D) £ PDUPF, 

and for all ra > 0, there is some p n with (p n , D) £ P_D U PF 

such that (p, Dp) C (p n , {Events Pre }), all events in p n — p are a-labeled, 

and for every d £ D p , 

there is some ra-length chain of a-labeled events in p n — p 

whose downward closure restricted to p is d 

For one case, suppose that (p, D) and all of the (p n , D) are in pomset-divergences((N , ^4cf))U 
pomset-failures((N , Act)). Then it follows by the highlighted equality above that 

(p, _D U Dp)— a £ extend Act{pomset-divergences([N , Act) — a)), 

and thus that (r,D r ) £ snd([(JV, aci)- a] MUST ). 

For another case, suppose that all of the (p n , D) £ augment(pomset-divergences((N, Act)))U 
augment(pomset-failures((N , Act))). Then there is some sequence {{q n ,D n ) : n > 0) such that 
each (p n ,D) y {q n iD n ) £ pomset-divergences((N,Act))Upomset-failures((N,Act)). Since 
Events^ is finite, there must be some subsequence ((q nk ,D nk ) : k > 0) and some set such that 
for all i > 0, all the D„ t are identical to some common D' and the ordering of all the q n . 
restricted to Events^ is identical. Let q be the pomset with this common ordering and with 
the same events and labels as p; it is easy to see that (q,D') ■< (p,D). Furthermore, assuming 
without loss of generality that n > |p|, it is easy to see that there is some set D q of downward- 
closed sets of Events^ such that D p C {down p (d) : d £ D q }, and (q,D'), D q , and the sequence 
((q„ k ,D nk ) : k > 0) are in the set on the right-hand side of the highlighted equality. By the 
first case, {q,D' U D q )— a £ extendA c t(pomset-divergences((N , Act) — a)). It is easy to see that 
(q, D' U D q )— a C (p, D U D p )— a; thus by Proposition 3.2.18, (p, D U D p )— a and (r, _D r ) are 
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in snd(l(N,act)-a] MVST ). 

For the last case, suppose that some (pi,D) £" augment(pomset-divergences((N,Act))) U 
augment(pomset-failures((N , Act))). If for all such i, there is some j > i with 
(pj,D) £ augment(pomset-divergences((N,Act)))Uaugment(pomset-failures((N,Act))), then 
substituting pj for p, yields a sequence that satisfies the earlier case. Otherwise, there must be 
some (pi,D) £" augment(pomset-divergences((N,Act)))Uaugment(pomset-failures((N,Act))) 
such that for all j > i, 

(pj,D) £" augment(pomset-divergences((N,Act)))U augment(pomset-failures((N , Act))). 

It is clear that there must be some sequence ((q n ,D n ): n > 0) such that each {q n ,D n ) £ 
mintz(pomset-divergences((N,Act))) and (p n ,D) £ augment( extend ActiiQmDn)))- Let p-related(D n 
be the set of d! P\ Events^ such that d! £ D n . It is easy to see that the number of distinct sets 
p-related(D n ) is finite; hence there must be some subsequence ((q nk ,D nk ) : k > 0) such that 
all the p-related(D nk ) sets are equal. By Proposition 3.2.14, pomset-divergences((N , Act)) is a 
prefix-closed set, and so we can assume without loss of generality that for ah n k > 0, there is no 
event x £ q„ k such that down qn (x) D d! for some d! £ D„ k . Using a straightforward finiteness 
argument on the length of chains that are unbounded in the p„ k but bounded in the q„ k , it is easy 
to show that there is some some subsequence ((q' n , D' n ) : / > 0) of {{q nk , Dn k ) '■ k > 0), some set 
D q i of prefixes of q' n , and some D' in the set on the right-hand side of the equality such that all 
the D' n = D' . Furthermore, it is easy to show that (p, DUD p )—a £ augment( extend Action , D'U 
D q i)— a)). By the first case, (q' n ,D no U D q i)— a £ augment(pomset-divergences((N , Act) — a)). 
Hence, by Proposition 3.2.18, (p, D U D p )— a £ snd(l(N, act) — a] MUST ) and hence so is (r, D r ). 
The proof that fst({(N, act)- a] MUST ) D fst({(N, act)j MVST - a) is similar and is left to the 
reader. 

Proposition 2.2.19 and the equalities for alphabet expansion and shrinking, CSP-style paral- 
lel composition, choice refinements, and hiding together immediately imply the compositionality 
of CCS-style parallel composition. ■ 

It is easy to show that for sequential nets, [-] MUST -equivalence and [-] TEST -equivalence respec- 
tively coincide with MUST-equivalence and Testing-equivalence. Thus, as a simple consequence 
of Proposition 3.1.6, the |.J MUST an d [•] TEST semantics are compositional for split refinements 
on sequential nets. 

However, in general: 

Proposition 3.2.33 |.J MUST an d [•] TEST are not compositional for split refinements or the CCS 
choice operator, + M . 

Proof. For the proof for split refinements, let (Ni,Act) and (N 2 ,Act) be the nets 

illustrated in Figure 3-4, and let Act = {a,a + ,a_,b}; this example is due to Frits Vaan- 
drager [38]. It is straightforward to show that {(N u Act)} MVST = [(JV 2 , Act)} MVST and that 
l(N 1 ,Act)}™ ST = l(N 2 ,Act)}™ ST . 
However, 

{a + ,{b}) £ snd(lsplit iaia+ia _ ) ((N 1 ,Act))r vsT ) - ^([^ a>a+>a _ ) ((JV 2 , ^))] MUST ). 
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Figure 3-4: Standard Example for Split Refinements 
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Figure 3-5: Standard Example for CCS choice 
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V— !— 
(N,Act) 



dupl-split({N , Act)) 

Figure 3-6: An Example of Duplicate- Splitting 

We note that neither (iV l7 Act) nor (JV 2 , Act) is a sequential net, since both of them can fire an 
a-labeled transition concurrently with a 6-labeled transition. 

For the proof of + M , let (Ni,Act) and (N 2 ,Act) be the nets illustrated in Figure 3-5, and 
let Act = {a,b}. It is straightforward to show that l(N u Act)] MVST = {(N 2 , Act)] MVST and that 
l(N u Act)] TEST = [(iV 2 ,,4rf)] TEST . However, 

(0,{6}> G snd(l(N 2 ,Act) + M 6] MUST ) - snd(\(N u Act) + M 6] MUST ). 



The difficulty with split refinements is that they make visible the failure sets of the net after 
transitions have "half-fired" , while the [.] MUST semantics does not keep track of this information. 
To correct this difficulty in our semantics, we first "duplicate-split" our nets; in particular, we 
"duplicate" every visible transition, then simultaneously "split" every duplicate transition into 
two consecutive transitions labeled cii and a 2 , where a is the label of the original transition. 
Furthermore, we relabel with a every visible transition of the original net, where a is the 
label of the original transition. We leave all r-labeled and -^/-labeled transitions untouched. 
Figure 3-6 gives an example. 

More formally: 

Definition 3.2.34 Let (JV, Act) be a WT Net. Then (P, Act') = dupl- split ( (JV ', Act)) is defined 
as: 



Act' = {at : ae Act -{^} and < i < 2} U {^} 
S P = S N V {(*,*) --teT N and i N (t) $ y, t}} 
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T P = T N \S {(t, 1), (t, 2):teT N and l N (t) £* W, r}} 

pre P {t) = pre N {t) 
pre P ((t, 1)) = pre N {t) 
pre P {{t,2)) = {{*,t)} 

postp(t) = post N (t) 
post P ((t,l)) = {(*,t)} 
post P ((t,2)) = post N (t) 

Ui) = { lN(t)o iU N(t)tW^} 

] ^N(t) otherwise 
l P ((t,l)) = l N (t) 1 
l P ((t,2)) = l N (t) 2 

Startp = Start N 

We note that: 
Proposition 3.2.35 WT Nets are closed under dupl- split. 

The proof is simple and is left to the reader. 

The difficulty with the -\- M operator is that the [.] MUST semantics does not keep track of 
initial firings of r-transitions; to correct this difficulty, we simply -\- M the dupl- split nets with 
a fresh, distinguished action 7, and take the [.] MUST semantics of the resulting net: 

Definition 3.2.36 Let (N,Act) be a WT Net and assume without loss of generality that 
7 g - Act. Then: 

{(N, Act)}%™ = [7 +m (dupl-split((N, Act)) grow { 7 })] MUST 
l(N,Act)}™£ d = f (l(N,Act)r A \l(N,Act)}™™) 

Theorem 3.2.37 [-]^y t s I, and l/]™^ on WT Nets are respectively adequate for MAY-equivalence, 
MUST-equivalence, and Testing-equivalence. 

Proof. From the definition of dupl- split and 7+M an d Proposition 3.2.18, it is straight- 
forward to show that 

J-((N,Act)) = {(v,F) : {v,F) is a linearly-ordered pomset-failure over Act 

and (v[f],{f(a):a G F}) e fst({(N , Act)]^), 
where f(a) = a for all a £ Act — {y/} and f(y/) = y/} 

V((N,Act)) = {v : v is a linearly-ordered pomset over Act 
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and (*[/], {Events,}) £ snd(l(N , Act)]™™), 

where f(a) = a for all a £ Act — {y/} and f(y/) = y/} 

Act = {a:a e third (l(N, Act)]™™)} U {y/} 



from which the adequacy of [-]^ t s I follows easily. The adequacy of l/]™^ is an immediate 
consequence of this fact and Theorem 3.2.12. ■ 

The ai-labeled transitions in dupl-split((N , Act)) yield essential information about the fail- 
ures of the net (JV, Act) after some transitions are "half-split." On the other hand, the a 2 -labeled 
transitions yield no new information. In fact, as we will show below, the pomset-failures and 
pomset-divergences of dupl-split({N , Act)) that contain any a 2 -labeled events can be fully re- 
covered from those contain no a 2 -labeled events by "splitting" some a -labeled events. 

We first observe that: 

Proposition 3.2.38 Let ( JV, Act) be a WT Net, and let p be a pomset-trace of dupl-split((N , Act)). 
Then: 

• For any a £ Act, if p does not contain any a 2 -labeled events, then every o^-labeled event 
is a maximal event in p. 



• 



• 



Let (p,F) be a pomset-failure of dupl-split((N , Act)). For any a £ Act, if p does not 
contain any a 2 -labeled events and does contain some c^-labeled event, then a 2 £" F. 

Let (p,D) be a pomset-divergence of dupl-split((N , Act)). For any a £ Act, if p does not 
contain any a 2 -labeled events, then no d £ D contains any c^-labeled events. 



The proposition is a simple consequence of the definitions of pomset-traces, pomset-divergences, 
and dupl- split] the details are left to the reader. 

Definition 3.2.39 Let Act 1 be a finite alphabet such that for some finite alphabet Act, Act 1 = 
{~f,y/} U {a, : a £ Act and < i < 2}. Let PF be a set of pomset-failures over Act', and let 
PD be a set of pomset-divergences over Act' . Then: 

l-2-respect(PF) = f {(p, F) £ PF : for every label a £ Act, 

p has no a 2 -labeled events 
and all c^-labeled events in p are maximal in p} 

l-2-respect(PD) = f {(p, D) £ PD: for every label a £ Act, 

p has no a 2 -labeled events, 
all c^-labeled events in p are maximal in p, 
and no d £ D contains any c^-labeled events} 

Definition 3.2.40 Let Act' be a finite alphabet such that for some finite alphabet Act, Act' = 
{7, y/}L){ai : a £ Act and < i < 2}. Let p be a pomset over ^4c£', let (p, F) be a pomset-failure 
over Act' , let (p, D) be a pomset-divergence, and let X C {x £ Events^ : l p (x) = a for some a £ 
Act}. Then 0-split x (p) is defined to be the pomset q with all events in X split, i.e.: 
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. Events, = ({(y, 0) : y £ Events p - X) U {(y, 1), (y, 2) : y G X}. 



l p {y) if i = 



lp(y)- otherwise 

• (y,i) < q (y',j) iff either y < p y' or (y = p y' and i < j). 
Furthermore, 0-split x ((p,D)) = (0-split x (p), {0-split x (d) : d G D}). We then define: 

O-split(p) = {0-split x (p) : X C {x G Events^ : / p (a;) = a for some a G ^4c^}} 
0-split((p, F)) = f {(q, F):q£ O-spUt(p)} 

0-split((p, D)) = {0-split x ((p,D)) : X C {x £ Events^ : l p (x) = a for some a G ^4c^}} 

We lift 0- split to sets of individuals by point-wise union. 

We remark that pomsets, pomset-failures, and pomset-divergences are preserved under 
0-split; the details are left to the reader. 

As promised, the pomset-failures and pomset-divergences of duplicate-split nets can be 
recovered from 1-2-respecting pomsets by O-splitting. 

Proposition 3.2.41 Let (N,Act) be a WT Net. Then: 

pomset-failures(dupl-split((N, Act))) = 

0-split(l-2-respect(pomset-failures(dupl-split((N, Act))))) 

pomset-divergences(dupl-split((N, Act))) = 

0-split(l-2-respect(pomset-divergences(dupl-split((N, Act))))) 

The proof is a straightforward consequence of the definitions of pomset-failures, pomset- 
divergences, and duplicate-splitting; the details are left to the reader. 

The presence of a 2 -labeled events does complicate split and choice refinements since corre- 
sponding o?! and a 2 events in a pomset-trace might not "match up" correctly during refinement; 
so, we restrict attention to pomsets without a 2 -labeled events. Similar to Proposition 3.2.41, 
we will be able to fully recover the refined a 2 -labeled events from the refined a -labeled events. 

Definition 3.2.42 Let Act' be a finite alphabet such that for some finite alphabet Act, Act' = 
{7, y/} U {a, : a G Act and < i < 2}. Let p be a pomset such that no event in p is labeled b 2 
for any b G Act, let (p, F) be a pomset-failure over Act' , let (p, D) be a pomset-divergence over 
Act' , and let a,a L ,a R be labels in Act. Then 

def 

0-l-choice (aiaLiaR) ({p, F)) = {{q,F q ): q £ choice (a0iaLOiaRo) (choice (aiiaLliaRl) (p)) 

F q C F p U {a ,ai,a 2 } 

and if a^o G F q or a^ G F q then ao £ F p 
if a Ll £ F q or a Rl £ F q then ai £ i 7 ^ 
if ciL2 G -F 3 then there is no a^-labeled event in q 
if a_R2 G F q then there is no a^-labeled event in </})) 
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Furthermore, 

0-l-choice iaiaLiaR) ({p, D)) = choice {a0taLotaRo) (choice {auaLitaRi) ({p, D))) 

In defining split refinements, we want to "fully split" each a -labeled event into the sequence 
a +0 .a_ . Furthermore, we want c^-labeled events to simulate half-firings of splits, and hence we 
have three choices for each c^-labeled event: relabel the event with a +1 , relabel the event with 
a+o, or split the event into a +0 .a_i. (The other two possibilities, a + i.a +2 and a +1 .a +2 .a_i, can 
be obtained from 0- splitting.) These choices are reflected below: 

Definition 3.2.43 Let Act' be a finite alphabet such that for some finite alphabet Act, Act' = 
{7, y/} U {a, : a £ Act and < i < 2}. Let p be a pomset such that no event in p is labeled b 2 
for any b £ Act, let (p, F) be a pomset-failure over Act' , let (p, D) be a pomset-divergence over 
Act' , and let a,a + ,a_ be labels in Act. Furthermore, let X ,Xi,X 2 be a partition of the set of 
a^labeled events of p. Then 0-l-split, a a a _s is defined to be the pomset q such that 

• Events^ = {(y,0) : y £ Events^ and l p {y) £" {a ,cii}} 

U {(y, 1) : y £ Events^ and l p {y) £ {a , aj} 

U {(y, 2) : y £ Events^ and either l p {y) = a or y £ X 2 }. 

/ p (y) if i = 

a +0 if i = 1 and y £" X 

• l q ((y, i)) = < «+i if i = 1 and y £ X 
a_ if i = 2 and y £" X 2 
a_! if i = 2 and y £ X 2 

• (2M) <« (y',i) iff either y < p y' or (y = p y' and i < j). 
We then define: 

def 

0-l-spUt (aa+ta _ ) (p) = {0-l-spUt (aa+ta _ tXotXitX2) (p) : X ,X 1 ,X 2 partition {x £ Events^ : l p (x) = ai }} 

0-lspti\a,a + ,a-)({P> D )) = W ', D ') ■ P' = "-- / - s P W ( a , a+l(I _ ) X 0l J 1 ,l 2 )(p) and 

D' = {0-l-splH (aia+ia _ iXoiXiiX3) (d) :d&D} 

for some Xo,Xi,X 2 that partition {x £ Events^ : l p {x) = ai}} 

0-lspti\a,a + ,a-)({P> F )) = W ', F ') ■ P' = «- lspllt (aa+ a _ XqXi ,x 2 )(p) 

for some Xo,Xi,X 2 that partition {2; £ Events^ : l p {x) = ai}, 

F'CfU {a ,ai,a 2 }, 

and if a + o £ F' or a + i £ i* 1 ' then ao £ i* 1 and ai £ F 

if X 7^ then a +2 £ F' 

if Xi 7^ then F' n {a_ , a_i} = 

if X 2 ^ then a_ 2 £ J 1 '} 

The following definition will be helpful in proving the compositionality of the [-]^ t s I and 
[•]™it-7 semantics for + M : 
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Definition 3.2.44 Let PF be a set of pomset-failures over a finite alphabet Act. Then 
init(PF) = f {a e Act : (a, 0) £ PF}. 

The following definition will be used heavily in our proof of compositionality for [-]^ t s I. In 
this definition, the presence of 7 in failure sets is used to indicate that some initial r-transitions 
have been fired. 

Definition 3.2.45 Let Act be a finite alphabet containing the distinguished symbol y/, let 
Act' = {(ii : a £ Act -{y/} and < i < 2} U {7, y/}, let PF, PF 1 ,PF 2 be sets of pomset-failures 
over Act', and let PD, PDi, PD 2 be sets of pomset-divergences over Act' . Let a, a L , a R , a + ,a_ £ 
Act— {y/}, let A be a subset of Act containing y/, let / be a function from Act to Act such 

that for all a £ Act, f(a) = y/ iff a = y/. Let {PF 7 , PD 7 , Act'} = f [(7, Act')j MVST , and for 
all a G ,4rf-{^}, let {PF a , v ,PD a , v ,Act'} d ^ {{N a , v , Act'}}™^, where JV aV is a net that 
can perform exactly an a-transition causally followed by a -^/-transition, after which the net 
deadlocks. 

The following definitions use the operators defined in Definition 3.2.29. The || operator 
remains the same as in Definition 3.2.29. 

{PF, PD, Act'} grow A d = {PF, PD, Act'} grow A 

{PF, PD, Act'} shrink A d = {PF, PD, Act'} shrink A 

a pref (PF, PD, Act'} d = (PF 7 , PD^Act'} + M {(PF a ^, PD aV , Act'}; ((PF, PD, Act'}\ 7 )) 

t pref (PF, PD, Act'} = f (PF 7 , PD 7 ,Act'} + M ((PF, PD, Act'}\j) 

(PF, PD, Act'} rst a d = (({PF, PD, ^ci')\a )\ai)\a 2 

(PF, PD, Act'} rename with / = f {PF, PD, Act')[f], 

where /'(a 8 ) = (/(a)) 8 - for all a £ Act and < i < 2, 
and /' is the identity on {7, y/} 

(PF, PD, Act'} hide a d = (({PF, PD, Act')-a )- ai)- a 2 



(PFuPDuAct') seq (PF 2 , PD 2 , Act'} d = (PF U PD U Act'}; ((PF, PD, Act'}\j) 
(PF^PD^Act'} internal choice (PF 2 , PD 2 , Act'} d = t pref {PF lt PD X , Act'} + M t pref (PF,PD,Act'} 



3.2. SOME COMPOSITIONAL SEMANTICS FOR WT NETS AND OPERATORS 63 



(PFuPDi, Act) + M (PF 2 , PD 2 , Act) = {PF 1 , PD', Act) 
where 
PF' = {(0,F): (0,FU{ 7 }) ePFiUPF 2 } 

U {(p, F) £ PFi U PF 2 : either p ^ or F (imt(PFi) U imt(PF 2 )) = 0} 
PD' = PD 1 U PD 2 



(PF l ,PD l ,Act l ) CSP-parallel^ (PF 2 , PD 2 , Act' d = (PF' , PD' , Act')) 
where 

(PF, PD, Act') = l-2-respect{{PFi,PDi,Act'))\\ A ,l-2-respect((PF 2 , PD 2 , Act')) 

A' = { ai : a £ A - {^} and < i < 2} U {7, y/} 
and 

_P_F' = augment(0-split(PF))U implied-failures Aci i(PD') 

PD' = augment(extend Aci i(0-split(PD))) 



choice( aiatiar) ((PF, Pi?, ,4c*')) = f (i 3 ^', PP', ^*') 

where 
(_P_F", PP", ,4c*') = 0-l-choice (ataLtaR) (l-2-respect((PF, PD, Act'))) 
and 
_P_F' = augment(0-spUt(P F")) U impUed-failures Act i(PD') 
PD' = augment(extend Aci i(0-split(PD"))) 



split (a , a+ , a _)«^, PP, ,4c*')) = f (i 3 ^', PP', ^*') 

where 
(PF", PP", Act') = 0-l-split {a>aL>aR) {l-2-respect{(PF, PD, Act'))) 
and 
PF' = augment(0-spUt(P F")) U impUed-failures Act i(PD') 
PD' = augment(extend Aci i(0-split(PD"))) 

(PPi, PPi, ,4c*') CCS-parallel PP 2 , PP 2 , ,4c*' = f 

(((PFj'.raj.Ad") CSP-parallel Au{7V} (PF' 2 ,PD' 2 , Act")) hide A) shrink Act' 
where 

(PP^, PD[, Act") = <t((PFi, PP i; ,4c*') grow A) 

(PF! 2 , PD' 2 , Act") = <t'((PF 2 , PD 2 , Act') grow A) 

and {ai,aT, . . .,a fc ,a£} = ,4c*' -{7, ^}, 

A = {a' 1; a' 1; . . . , a' k , a' k } are distinct symbols not in Act , 

a is the sequence choicer, „, „m • choice / — s . . .choicer,,, „, „n • choice / — s, 

^ ^ai,ai,a 1/ l (a^a^a'J V a fe) a fe) a fe^ (0^,0^,0^)' 

and a' is the sequence choice, —r. ■ choicer-^- 77- „m • • • choice, -t- x • choicer-^- 77- „/ ^ 

^ (01,01,0'J k«i ,«i >«! J (a k ,a k ,a' k ) \ak,ak,"- k ) 

We now show: 

Theorem 3.2.46 [-]^ t s I and [•]™ ; t T / are compositional for split refinements, choice refine- 
ments, alphabet expansion and shrinking, and all of our CCS/CSP operators. 
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Proof. Let Act be a finite alphabet containing \/ , let a, a L , a R , a + ,a_ £ Act, let A C Act, 
let / be a function from ^4c£ to Act such that for all a £ ^4c£, /(a) = \J iff a = ^/, and let Act' 
be a finite set of labels containing y/. Furthermore, let (N , Act) , (Ni, Act) , (N 2 , Act) be WT 
Nets. 

The following identities hold, where the operations on the right-hand side of the equations 
are those defined in Definition 3.2.45: 

l(N,Act) grow Act'}*™ = l(N,Act)}™™ grow Act' 
l(N, Act) shrink Act'}™™ = {(N, Act)}™™ shrink Act' 
{a.(N, Act)}*™ = a pref {(N, Act)}*™ 
{t.{N, Act)}™™ = r pref {{N, Act)}™™ 
l{N,Act)\a}™™ = l{N,Act)}™™ rst a 
l(N,Act)[f]}™™ = l(N,Act)}™™ rename with / 
{(N, Act)- a}™™ = 1{N, Act)}™™ hide a 
l{N u Act);{N 2 ,Act)}%™ = {{N^Act)}™™ seq l{N 2 ,Act)}™™ 
UN,, Act) + M {N 2 ,Act)}™™ = {{N^Act)}™™ + M {(N 2 , Act)}™™ 

UN,, Act) (N 2 ,Act)}™™ = {(N^Act)}™™ internal choice 1{N 2 , Act)}*™ 
{{NuAct) || (N 2 ,Act)}™™ = {{N^Act)}™™ \\ l{N 2 ,Act)}™™ 
l{N u Act)\\ A {N 2 ,Act)}%™ = {{N^Act)}™™ CSP-parallel Au{7V} l{N 2 ,Act)}™l 
UN,, Act) | {N 2 ,Act)}™™ = {{N^Act)}™™ CCS-parallel (N 2 ,Act) 
lchozce (ataLtaR) ((N, Act))}™™ = choice^, taR) ({(N, Act)}™™) 

hP^(a,a + ,a.)({N,Act))}™™ = Split (ai(1+ , a _ ) (1{N , Act)}™™) 



MUST 



The proof for CSP-style parallel composition is essentially the same as that in Theo- 
rem 3.2.32, except it uses the following easily proved fact: 



3.2. SOME COMPOSITIONAL SEMANTICS FOR WT NETS AND OPERATORS 65 



pomset-failures(y +m (dupl-split((Ni, Act)\\A(N2, Act}) grow {7})) = 

0-split({(p, F) : (j>i,Fi) G F2-respect(pomset-failures(y +m (dupl-split((Ni, Act}) grow {7}))), 
{P'ZjF'z) G F2-respect(pomset-failures(y +m ( dupl- split {{N2, Act)) grow {7}))), 
and p G Pi\\a>P2, F - A' C F 1 C\ F 2 and FnA'C^U F 2 , 
where A' = {a; : a G A and < i < 2} U {^/}) 

poms et- divergences^ +m (dupl-split((Ni, Act)\\A{N2, Act)) grow {7})) = 
0-split([\{{ Pl ,D l )\\ A ^ P 2,D 2 ): 

(pi,Di) G F2-respect(pomset-divergences(y +m (dupl-split((Ni, Act}) grow {7}))) 

U F2-respect(pomset-failures(y +m (dupl-split((Ni, Act}) grow {7}))), 
(P2,F>2} G F2-respect(pomset-divergences(y +m ( dupl- split ((N2, Act}) grow {7}))) 

U F2-respect(pomset-failures(y +m ( dupl- split ((N2, Act}) grow {7}))), 
D\ and D2 are (possibly empty) downward-closed subsets of 
Events Pl and Events P2 , respectively, and D\ U D2 7^ 0, 
and A 1 = {ai : a E A and < i < 2} U {^/}) 

The proofs for choice refinement and split refinement follow straightforwardly from Propo- 
sition 3.2.18 and the easily proved facts that: 

pomset-failures(y +m (dupl-split(choice/ aaLtaR \((N, Act})))) = 

0-split(0-Fchoice( aaLaR \(F2-respect(pomset-failures(y +m (dupl-split((N, Act}) grow {7}))))) 

pomset- divergences^ +m { dupl- split( choice/ aaL t a R )((N , Act))))) = 

0-split(0-Fchoice( aaLaR \(F2-respect(pomset-divergences(y +m (dupl-split((N, Act}) grow {7}))))) 

pomset-failures(y +m (dupl-split(splitt a a a _A{N , Act))))) = 

0-split(0-Fsplitr a a _\(F2-respect(pomset-failures(y +m (dupl-split((N, Act}) grow {7}))))) 

pom set- divergences^ +m { dupl- split( choice/ aa , a _)((./V , Act))))) = 

0-split(0-Fsplitr a a _\{l-2-respect{pomset- divergences^ +m (dupl-split((N, Act}) grow {7}))))) 

The proof for hiding is analogous to that in Theorem 3.2.32. The proofs of the remaining 
equalities are left to the reader. We remark that Proposition 2.2.18 and the equalities for 
prefixing and CCS choice together imply the compositionality of internal choice. Furthermore, 
Proposition 2.2.19 and the equalities for alphabet expansion and shrinking, CSP-style parallel 
composition, choice refinements, and hiding together imply the compositionality of CCS-style 
parallel composition. 

The compositionality of l/]™^ then follows easily from the above proofs together with 
Theorem 3.2.30. ■ 

In fact, [-]^ and [-]™t T 7 make just the right distinctions with respect to [-] MUST , [-] TEST , 
and our WT Net operators: 

Theorem 3.2.47 [-]^ t s I and l/]™^ are fully abstract for split refinements, choice refine- 
ments, and all of our CCS/CSP operators with respect to [.] MUST and [•] TEST , respectively. 
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Proof. From the definition of dupl- split and 7, it is easy to see that 

fst({{N,Act)j MVST ) = {{p,F} : (p,F) is a pomset-failure over Act 

and (p[f]Af(a) : a G F}) G fst({(N, Act)]^), 
where f(a) = a for all a G Act — {1/} and f(i/) = if} 

snd(l(N, Act)J MVbT ) = {(p,D) : p is a pomset-divergence over ^4c£ 

and(p[/], J D)G S nrf([(iV,^)C^), 

where /(a) = «o f° r all a G ^4c£ — {1/} and /(y 7 ) = y 7 } 

Act = {a:a e third({(N,Act)}^)} U {y 7 } 



from which adequacy follows easily. 

Theorem 3.2.46 has shown that [-]fy t s .^ and l/]™^ are compositional for all the WT Net 
operators. To prove full abstraction, we observe that 7 -\- M (dupl-split(-) grow {7}) can be 
programmed by CCS choice and a finite sequence of choice and split refinements, together with 
some alphabet-expansion and shrinking. In particular, assuming that {a] : a 1 G Act and < 

i < 2} CiAct = 0, 

7 +m (dupl-split((N , Act)) grow {7}) = 7 +m (( (T ((^? Act) grow Act')) shrink Act') 
where a is the sequence split^^^ . . . split (ak a , a * } • choice^ ^^ . . . choice^^^j, 

Act — {1/} = {a 1 , . . . , a k }, Act' = {a\ : a 1 G ^4c£ and < i < 2} U {y 7 , 7}, and equality refers 
to net isomorphism. If a] G Act for some a 1 G ^4c£ and some < i < 2, the equality above 
can be suitably modified to use different "fresh" variables and renaming. The theorem is then 
a simple consequence of this equality and the definition of [-]^ t s I and H/]™^.-- ■ 

However, as we will prove in the next section, [-] MAY , [•]^u t s I, and H/]™^.- are not fully 
abstract for our WT Net operators with respect to MAY-equivalence, MUST-equivalence, and 
Testing-equivalence, respectively. The complication is that these semantics make strictly more 
distinctions than our net contexts. 

We remark here that keeping track of concurrent divergences is necessary for composition- 
ality with respect to parallel composition. In particular, suppose we modify the definition of 
pomset-divergences, (p,D), so that D must be a singleton set. Then the redefined [-]fy t s .?! 
semantics based on this modified version of pomset-divergences will not be compositional for 
parallel composition, which was the difficulty faced by Vogler [47, 49]. Our [-]fy t s .?! semantics 
avoids this difficulty by keeping track of concurrent divergences, and resolves an open prob- 
lem posed in [49]. The difficulty with keeping track of only single divergences is illustrated in 
Figure 3-7. It is easy to see that (Ni,Act) and (N 2 ,Act) have the same meanings under the 
redefined |[-]^y t s I semantics and that (N 3 ,Act) and (N^^Act) have the same meanings under 
the redefined [-]^ t s I semantics, where Act = {a,b,c,d}. However, (p, {e a ,e c }) is a pomset- 
single- divergence of (N 2 ,Act) \\ (N^^Act), while it is not an augmentation of any extension of 
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Figure 3-7: An Example of the Necessity of Concurrent Divergences 



any pomset-single-divergence {q,{d}) of (Ni, Act) \\ (N 3 ,Act). 



3.3 Fully Abstract Semantics 

It turns out that [-] MAY , [•]^J; t s I, and I/]™.- make more distinctions than are apparent to a 
single experimenter. Namely, single experimenters can only detect differences between pomsets 
with interval orderings [32, 47]. We repeat the definition here: 

Definition 3.3.1 A partial order < is is an interval ordering iff whenever both w < x and 
y < z, then either w < z or y < x. A pomset p is an interval pomset iff < p is an interval 
ordering. 

It is well-known (c/. [14]) that: 

Lemma 3.3.2 ([14]) Every interval ordering, < p , is order-isomorphic to a set of intervals of 
the real line, where by definition, (interval w) < (interval x) iff every point in (interval w) 
strictly precedes every point in (interval x). 
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We define a corresponding version of "intervai pomset-divergences": 

Definition 3.3.3 A pomset-divergence {p,D) is an interval pomset-divergence iff p is an in- 
tervai pomset and D = {d} for some d that contains all the non-maximal events of p, i.e., 
d D Event s p — max(p). 

We define the interval- MAY-, interval- MUST-, and interval- Testing semantics by restricting 
the [-] MAY , [•]^u t s I, and l/]™^ semantics to interval pomsets and interval pomset-divergences: 

Definition 3.3.4 Let V be a set of pomsets, let VT be a set of pomset-failures, and let 
VT> be a set of pomset-divergences. Then intervals(V) is the set of interval pomsets p G V, 
intervals(V T) is the set of {p,F) G VT such that p is an interval pomset, and intervals(W) 
is the set of interval pomset-divergences {p,D) G PD. 

For any alphabet Act, let intervals((V , Act)) = (intervals(V), Act) , and let 

intervals((VJ-,W,Act)) = (intervals(VJ-),intervals(VV),Act). 

Definition 3.3.5 For any WT Net (N,Act), 

[JVEfJ d = intervals({Nj MAY ) 
iNj^r, = intervalsdN}™™) 

We have: 

Theorem 3.3.6 The [-]^7, [•] 1 ^.^, and [-J™^ semantics are respectively adequate for MAY- 
equivalence, MUST-equivalence, and Testing- equivalence. 

Proof. We first note that all linear orderings are interval orderings. The proof is then 
identical to that of Theorem 3.2.37. ■ 

The following facts will be useful in proving the compositionality of the interval semantics: 

Proposition 3.3.7 Let p,pi,p 2 ,q be pomsets. 

1. If p is an interval pomset and q is a prefix of p, then q is an interval pomset. 

2. a.p is an interval pomset iff p is an interval pomset. 

3. p[f] is an interval pomset iff p is an interval pomset. 

4. Pi',P2 is an interval pomset iff pi; \J and p 2 are interval pomsets. 

5. q G choice( aaLaR - } (p) is an interval pomset iffp is an interval pomset. 

6. If q is an interval pomset and q = p — a for some pomset p, then there is some interval 
pomset p' y p such that q = p' — a. 

7. If q is an interval pomset and q G augment(pi\\ A p 2 ) , then there are interval pomsets p[,p 2 
with p[ y pi, p' 2 y p 2 such that q G augmentip'^Ap^). 
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8. If q is an interval pomset and q £ augment(split a \(p)) for some pomset p, then there 
is some interval pomset p' y p such that q £ augment ( split a ai a2 )(p'))- 

9. If q is an interval pomset and q £ augment(0-split(p)) for some pomset p, then there is 
some interval pomset p' y p such that q £ augment(0-split(p ')) . 

Proof. We prove the case for hiding. Suppose q is an interval pomset and q = p — a 
for some pomset p. Let p' have the same events with the same labels as p, and let < p < be 
a partial order that is maximal with respect to the following conditions: (i) < p i contains < p , 
and (ii) < p < agrees with < p on all non-a-labeled events of p. Clearly, such a pomset p' exists 
since < p satisfies conditions (i) and (ii). Furthermore, it is easy to see by construction of p' 
that p' — a = p — a = q. Let x < p < y and z < p < w, and suppose for the sake of contradiction 
that x <fi p i w and z -jt v i y. Then by maximality of < p <, there must be some non-a-labeled 
events x',y',z',w' such that x' < p x, y < p y', z' < p z, w < p w', and x' <fi p w' and z' -jt p y', 
contradicting the fact that p — a is an interval ordering. Hence, either x < p < w or z < p i y after 
all, and so p' is an interval pomset. 

The remaining cases are straightforward and are left to the reader. ■ 

Similarly: 

Proposition 3.3.8 Let (p, D p ) , (pi, Di) , (p 2 , D 2 ) , {q, D q ) be pomset-divergences. 

1. If (p,D p ) is an interval pomset-divergence and (q,D q ) is a prefix of (p,D p ), then (q,D q ) 
is an interval pomset. 

2. a.(p,D p ) is an interval pomset-divergence iff (p,D p ) is an interval pomset-divergence. 

3. (p,D p )[f] is an interval pomset-divergence iff (p,D p ) is an interval pomset-divergence. 

4. (pi;p 2 ,{d U Events Pl : d £ D 2 }) is an interval pomset-divergence iff pi]\/ is an interval 
pomset and (p 2 ,D 2 ) is an interval pomset-divergence. 

5. (q,D q ) £ 0-l-choice( aaLaR - } ([p,D p )) is an interval pomset-divergence iff (p,D p ) is an in- 
terval pomset-divergence. 

6. If (q,D q ) is an interval pomset-divergence and (q,D q ) = (p,D p ) — a for some pomset- 
divergence (p,D p ), then there is some interval pomset-divergence 

(p',D p i) £ augment (extend Act ({p, D p ))) such that (q,D q ) = (p',D p i) — a. 

7. If (q,D q ) is an interval pomset-divergence and (q,D q ) £ augment((pi, Di)\\ A (p 2 , D 2 )), 
then there are interval pomset-divergences (p[, D[), (p' 2 , D' 2 ) with (p^D^) y (pi,Di), 
{P 2 ,D' 2 ) y {p 2 ,D 2 ) such that (q,D q ) £ augment^p'^ D[)\\ A {p 2 , D' 2 )). 

8. If (q, D q ) is an interval pomset-divergence and (q, D q ) £ augment(0-l-spUt aa _J(p,D p ))) 
for some pomset-divergence (p, D p ), then there is some interval pomset-divergence (p', D p i) y 
{p,D p ) such that (q,D q ) £ augment{0-l-split (ata+ta _ } {(p' , D p ,))). 
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Proof. We prove the case for hiding. Suppose (q,D q ) is an interval pomset-divergence 
and (q, D q ) = (p, D p ) — a for some pomset-divergence (p, D p ). Let p' be defined as in the proof 
of Proposition 3.3.7 and let D p * = {d 1 }, where d! = down p i(d) U (Events^/ — max(p')) for some 
d G D. By the earlier proof and by construction of D p i, clearly, (p',D p >) is an interval pomset- 
divergence and (p,D p ) Q (p,D p i) ^ (p',D p i). Since (q,D q ) is an interval pomset-divergence, 
D q = {d q } for some d q D Events^ — max(q); it is then easy to see from the construction of 
(p',D p i) that (p',D p i) — a = (q,D q ), proving this case. 

The remaining cases are straightforward and are left to the reader. ■ 

We will also use the following fact about interval pomset-divergences: 

Lemma 3.3.9 Let (p,D p ) be a (possibly non-interval) pomset-divergence and let (q,D q ) be 
an interval pomset-divergence with (p,D p ) Q (q,D q ). Then there is some interval pomset- 
divergence (p',{d'}) with (p',{d'}) Q (q,D q ) such that p' is a prefix of p and d! D d for some 
d e D p . 

Proof. By the definition of interval pomset-divergences, D q = {d q } for some d q D 
Events^ — max(q). 

We first show that there is some d G D p such that (p,{d}) C (q,{d q }). The proof is by 
induction on n = |Events g — Events p |. The base case of n = is obvious. For the other 
base case, let n = 1, and let {x} = Events^ — Events^. Clearly, there is some d G D p with 
d C down q (x); furthermore, d C down q (x) C Events^ — max(q) C d q , and so (p, {d}) C (g, {d q }). 

For the inductive step, suppose that n > 1. Let {xi, . . . , x n } = Events^ — Events^, and 
assume wlog that x n G max(q). It is easy to see that (q — x n , {d q — x n }) is an interval pomset- 
divergence and that (p,D p ) Q (q — x n ,{d q — x n }); by the inductive hypothesis, there is some 
di G Dp with (p, {di}) C (q — x n , {d q — x n }). If di C down q (x n ), then clearly (p, {di}) Q (q,{d q }). 
Otherwise, there is some y G di such that y <fi q x n ; we recall that y < q x, for all 1 < i < n 
since (p, {d{\) Q (q — x n , {d q — x n }). Now consider any z < q x n ; since q is an interval ordering, 
it follows that z < q x, for all 1 < i < n. Thus, down q (x n ) C down q (xi) for all 1 < i < n. Since 
(p,D p ) Q (q,{d q }), there is some d G D p with d C down q (x n ) C down q (xi) for all 1 < i < n. 
Furthermore, d C down q (x n ) C Events^ — max(q) C d q , and so (p,{d}) C (q,D q ) as desired. 

Now let p' be the restriction of p to the set {x G Events^ : d <£. down p (x)} , which is easily seen 
to be a downward- closed subset of Events^. Furthermore, let d! = rfU(Events p ' — max(p')), which 
is easily seen to be a downward- closed subset of Events^/ . Since d C d q and Events^/ — max(p') C 
Events^ — max(q) C d q ,'\t is easy to see that d! C d q . Let x £ d' and let z G Events^ — Events^/. 
For one case, let x G d; then it is easy to see that x < q z. For the other case, let x G d' — d; 
then there is some x' G p' such that x < p i x' and d <£. down p (x r ); so there is some y £ d 
with y jt p x' . It is easy to see that y < q z, and since q is an interval pomset, it follows that 
x < q z, proving that (p', {d 1 }) C (g, {d q }). Clearly, prefixes of interval pomsets are also interval 
pomsets, from which it follows easily from the construction of d! that (p', {d 1 }) is an interval 
pomset-divergence, proving the lemma. ■ 



Theorem 3.3.10 The [-]^7, [•]hJ t ^I, and l/]™^ semantics are compositional for split re- 
finements, choice refinements, alphabet expansion and shrinking, and all of our CCS/CSP 
operators. 
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Proof. Let Act be a finite alphabet containing y/, let a, a L , a R , a + ,a_ £ Act, let A C ^4c£, 
let / be a function from Act to ^4c£ such that for all a £ Act, f(ot) = y/ iff a = y/, and let Act' 
be a finite set of labels containing y/. Furthermore, let (N , Act) , (Ni, Act) , (N 2 , Act) be WT 
Nets. 

The following identities, where the operations on the right-hand side of the equations are 
those defined in Definition 3.2.28, follow immediately from the augmentation- closure of the 
j-.jmay seman tics, Proposition 3.3.7, and Theorem 3.2.30. The details are straightforward and 
are left to the reader. 

l(N,Act) grow Act'}™ = l(N,Act)]™ grow Act' 
{(N, Act) shrink Act']™ = {(N, Act)]™ shrink Act' 
la.(N,Act)]™ = a.l(N,Act)]™ 
lr.(N,Act)]™ = l(N,Act)]™ 
l(N,Act)\a]™ = l(N,Act)]™\a 
l(N,Act)[f]]™ = l(N,Act)]™[f] 
l(N,Act)-a]™ = l(N,Act)]™-a 
{(N,, Act); (N 2 , Act)]™ = [(N u Act)]™; [<JV 2 , Act)]™ 
{(N,, Act) 8 (N 2 ,Act)]™ = {(N,, Act)]™ ® l(N 2 , Act)]™ 
[(N^Act) + M {N 2 ,Act)]™ = {{N,, Act)]™ + M {{N 2 ,Act)]™ 
[(N^Act) || (N 2 ,Act)}™ = tntervalsiUN^Act)]™ \\ {{N 2 ,Act)]™) 
l(N 1 ,Act)\UN 2 ,Act)]™ = i ntervals(l(N 1 ,Act)]™\\^^ 
[(N^Act) | (N 2 ,Act)}™ = tntervalsiUN^Act)]™ \ {{N 2 ,Act)]™) 
lchotce (ataLtaR) ((N,Act))]™ = chotce (ataLtaR) (l(N,Act)]™) 

lspUt (ataita2) ((N, Act))]™ = zntervals(spUt (ataita2) (l(N, Act)]™)) 
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The following identities follow immediately from the augmentation- closure of the [-]^ t s I 
semantics, Proposition 3.2.14, Proposition 3.2.18, Proposition 3.3.8, Proposition 3.3.9, and 
Theorem 3.2.46. The operations on the right-hand side of the equations are those defined in 
Definition 3.2.45. We prove the case for CSP-style parallel composition; the remaining equalities 
are left to the reader. 



1{N, Act) grow Act'}™** = intervals(l{N,Act)}%™ T y grow Act') 
l(N, Act) shrink Act'}™™ = {(N, Act)}™^^ shrink Act' 

la.{N,Act)}%™ = intervals(a pref {{N , Act)}™^) 
lr.{N,Act)}™™ = intervals(T pref {{N,Act)}™™) 
l(N,Act)\a}%™ = intervals(l{N,Act)}^^ rst a) 
l(N,Act)[f\}%™ T y = intervals(l(N,Act)}^ T y rename with /) 
l(N,Act)- a}%™ = intervals(l{N,Act)}^^ hide a) 
{{N^Acty^N^Act)}™™ = intervals(l{N u Act)}%™ seq 1{N 2 , Act)}™™) 
{{NuAct) + M (N 2 ,Act)}™™ = l(Ni,Act)}%™ +m 1{N 2 , Act)}™™ 

UN,, Act) {N 2 ,Act)}™™ = {{N^Act)}™™ internal choice {{N 2 , Act)}"™ 

l{N u Act) || {N 2 ,Act)}%™ = intervals(l{N u Act)}%™ II l(N 2 ,Act)}™™) 

{(NuAcQWAiN^Act)}™™ = intervals^, Act)}™™ 7 CSP-parallel Au{7i>/} 1{N 2 , Act)}™™^ 
Km, Act) | (N 2 ,Act)}™™ 7 = intervals^, Act)}™™ 7 CCS-parallel (N 2 ,Act)) 
lcho t ce (ataLtaR) ((N, Act))}™™ = zntervals(choice (ataLtaR) (l(N, Act)}™™)) 
lspli\a,a +l a-)((N, Act))}™^ = intervalsfoKt^^MN, Act)}™™)) 



We prove the equality for CSP-style parallel composition. It is easy to see that one direction 
follows easily from Theorem 3.2.46 and the monotonicity of all the operations. To prove the 



3.3. FULLY ABSTRACT SEMANTICS 73 

other direction, we first recall from the proof of Theorem 3.2.46 that: 

pomset-failures(y +m (dupl-split((Ni, Act)\\A(N2, Act}) grow {7})) = 

0-split({(p, F) : (j>i,Fi) G F2-respect(pomset-failures(y +m (dupl-split((Ni, Act}) grow {7}))), 
{P'ZjF'z) G F2-respect(pomset-failures(y +m ( dupl- split {{N2, Act)) grow {7}))), 
and p G Pi\\a>P2, F - A' C F 1 C\ F 2 and FnA'C^U F 2 , 
where A' = {a; : a G A and < i < 2} U {V}) 

pomset- divergences^ +m {dupl-split({Ni, Aci)\\a{N2, Act)) grow {7})) = 
0-split(\J{( Pl ,D 1 )\\ A '(p2,D 2 ): 

(pi,Di) G F2-respect(pomset-divergences(y +m (dupl-split((Ni, Act}) grow {7}))) 

U F2-respect(pomset-failures(y +m (dupl-split((Ni, Act}) grow {7}))), 
(P2,F>2} G F2-respect(pomset-divergences(y +m ( dupl- split ((N2, Act}) grow {7}))) 

U F2-respect(pomset-failures(y +m ( dupl- split ((N2, Act}) grow {7}))), 
D\ and D2 are (possibly empty) downward-closed subsets of 
Events Pl and Events P2 , respectively, and D\ U D2 7^ 0, 
and A 1 = {ai : a E A and < i < 2} U {V}) 

Let (r,D r ) G sud^, Act)\\ A (N 2 , Act)}"™); then 

(r,D r ) G intervals( augment( extend Act{{p,D v )))) 

for some pomset-divergence (p, D p ) of (iV l7 Act)\\ A {N2, Act). By Lemma 3.2.16 and Lemma 3.3.9, 
there is some interval pomset-divergence (q, {d 1 }}) such that (r,D r ) G augment( extend A c t({q,{d'}))), 
q is an augmentation of a prefix of p and d' D d for some d G D p . By Proposition 3.2.14, 

(q, {d 1 }) G extendAct(augment(pomset-divergences((Ni, Act)\\ A {N2, Act)))). 

It then follows easily from the highlighted fact above and the definitions of augment and 0-split 
that (q, {d 1 }) G extendAct((iugment(0-split((p' , D p i)))) for some (p',D p i) G (pi, Di)\\ A >{p2i D 2 )), 
where (pi,Di),(p2,D 2 ) are appropriate pomset-divergences or pomset-failures. 

It follows from Lemma 3.3.9 and Proposition 3.3.8 that there are some interval pomset- 
divergences {q',D q ,} y (p',D p >), (qi,D qi ) y (pi,-Di), (q2,D q2 ) h (P2, D 2 ) such that (q,{d'}) G 
extend Act{augment( 0- split([q' , D q i)))) and (q',D q >) G augment((qi,D qi )\\ A '{q2,D q2 )). From the 
definition of 0-split and augment and Lemma 3.2.16, it is easy to see that 

(q,{d'}) G augment{extend Act {0-split{{q u D qi )\\ A '{q2,D q2 )))) 

The desired equality then follows easily. The proof for pomset-failures is similar, except that it 
uses Proposition 3.3.7 instead of Proposition 3.3.8. 

Proposition 2.2.18 and the equalities for prefixing and CCS choice together imply the com- 
positionality of internal choice. Proposition 2.2.19 and the equalities for alphabet expansion 
and shrinking, CSP-style parallel composition, choice refinements, and hiding together imply 
the compositionality of CCS-style parallel composition. ■ 

Theorem 3.3.11 The [-]^ A J, [-]^^, and [1™st sem antics are respectively fully abstract for 
MAY-equivalence, MUST-equivalence, and Testing-equivalence with respect to alphabet expan- 
sion, split refinements, choice refinements, and CCS choice. Furthermore, only split and choice 
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refinements are necessary for [-]^y. 

Proof. By Theorem 3.3.6 and Theorem 3.3.10, it remains to prove distinguishability. 
Let (N u Act 1 ),(N 2 ,Act 2 ) be WT Nets. For one case, let (PT u Ach) = l(N u Ach)}^ , let 
(PT 2 ,Act 2 ) = l(N 2 ,Act 2 )}^, and suppose that {PT u Ach) ^ (PT 2 ,Act 2 ). If Act x /*Act 2 , it 
is easy to see that the nets are MAY-inequivalent. Otherwise, Act\ = Act 2 = Act and PT X ^ 
PT 2 ; we assume wlog that there is some interval pomset p £ PT\ — PT 2 . Let n = | Event s p |, 
and let Act 1 = {a J ,a[,a 2 : a £ Act and 1 < j ' < n} be distinct symbols not in Act. Finally, let 
C[-] be the following net context: 

C[-] = a(8(- grow Act')), 

where 8 is the sequence of choice refinements l K choice( aa i i ..., a ») : a £ Act) (which can be pro- 
grammed by repeated use of binary choice refinements), and a is the sequence of split refine- 
ments (sp% v i ia i) • ..split^^^ : a £ Act). 

We will perform corresponding split and choice refinements on pomsets. Using Defini- 
tion 3.2.25, we can overload notation and let 8 also represent the obvious sequence of choice 
refinements on pomsets. For concreteness, we will "fully split" ah events in p, and so, using 
Definition 3.2.26, we let a' = (split^^^ . ■ -split^^^^ : a £ Act). 

Since n = Events^, it is easy to see that there is some pomset q £ a'(8(p)) such that q 
is an augmentation of a pomset-trace of C[iV"i] and all labels in q are distinct. Furthermore, 
since we implicitly equate isomorphic pomsets, it is easy to see that we can assume wlog that 
Events,, = {(y,l),(y,2)\y £ Events^}, l q ((y,i)) = (l p (y))i for some 1 < k < n, and (y,i) < q 
(y',j) iff either y < p y' or (y = p y' and i < j). Clearly, there is a unique (injective) mapping / 
from events x of p to labels a 1 , where I(x) = a 1 iff l p (x) = a and l q ((x, 1)) = a\. For any event 
x of p, we can regard the (unique) J(a;) 1 -labeled and I(x) 2 -labeled events of q as respectively 
representing the "beginning" and "end" of the interval corresponding to x. Now, since p is an 
interval pomset, it follows by Lemma 3.3.2 that there is a linearization v of q such that (the 
unique) a 8 2 -labeled event precedes (the unique) 6^-labeled event in v iff I -1 (a 1 ) < p J _1 (6 J ). 

Clearly, v £ traces(C[Ni]). If v £ traces(C[N 2 ]), there would be some pomset-trace p' of 
N and some q' £ a'(8(p')) such that v is a hnearization of q'; thus, all events in q' must have 
distinct labels. Clearly, there is a unique (injective) mapping I' from events x of p' to labels 
a 1 , where I'(x) = a 1 iff l p i{x) = a and l q i((x, 1)) = a\. It is then easy to see that J -1 o I' is a 
label-preserving order- augmenting bijection from p' to p. But by definition of [-]^y, this would 
imply that p £ PT 2 , a contradiction. Thus, v £ traces(C[Ni\) — traces(C[N 2 ]) after all, and so 
by Proposition 3.1.4, C[iV"i] and C[iV"2] are MAY-inequivalent, proving this case. 

To prove that [-]^ is folly abstract, let (PF^PD^Act',) = {(NuAch)}™™, let 
(PF 2 ,PD 2 ,Act' 2 ) = l{N 2 ,Act 2 )jf2r^ and suppose that {PF U PD U Act[) ^ (PF 2 ,PD 2 ,Act' 2 ). 
If Act[ j^ Act' 2 , it is easy to see that Act\ ^ Act 2 and hence the nets are MUST-inequivalent. 

For the next case, suppose PD\ ^ PD 2 ; we assume wlog that there is some interval 
pomset-divergence (p, {d p }) £ PD\ — PD 2 . Using Proposition 3.2.15, Proposition 3.2.17, and 
Lemma 3.3.9, we can assume wlog that there is some d C d p such that (p, {d}) is an augmenta- 
tion of a pomset-divergence (r,{d r }) of 7 -\- M (dupl-split((Ni, Act)) grow {7}); the details are 
straightforward and are left to the reader. From the definition of 7+M an d the definition of WT 
Nets, r, and hence p, does not have any 7-labeled or -^/-labeled events. By Lemma 3.2.41, we 
can assume wlog that r, and hence p, does not contain any a 2 -labeled events for any a £ Act. 
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By Proposition 3.2.38, it is easy to see that for all a £ Act, every o^-labeled event is maximal 
in r; thus, we can assume wlog that for all a £ Act, every o^-labeled event is also maximal in p. 
Again using Proposition 3.2.38, it follows that d r , and hence d, contains only a -events; thus, 
we can assume wlog that d p contains all and only the a -events of p. Let Act', a, and S be as 
in the previous case, and let 

C[-] = 7 +m (t(6(- grow Act' U {7})). 

Furthermore, let n = |Events p |, and let S' be the sequence (choice^ aoa i ,...<,») : a £ Act) followed 
by the sequence (choice^ ai a i t ... a n ) '■ a & Act). We let a' be as in the previous case. 

It is easy to see that there is some pomset-divergence (q, {d q }) £ a'(S'((p, {d p }))) such that 
all labels in q are distinct, d q contains all and only the a 2 -labeled events of q for all a £ Act, and 
for some d! C d q , (q,{d'}) is an augmentation of a pomset-divergence of C[iVi]. Furthermore, 
in q all a -labeled events of p have been "fully split," while all o^-labeled events of p have been 
relabeled. Again, since we implicitly equate isomorphic pomsets, it is easy to see that we can 
assume wlog that 

• Events^ = {(y, 1), (y,2) \ y £ Events^ and l p (y) = a for some a £ Act} U 
{(y, 1) I y £ Events^ and l p (y) = «i for some a £ Act} 

• l q ((y,i)) = {l v {y)) k i for some 1 < k < n, and 

• (y,i) < q (y',j) iff either y < p y' or (y = p y' and i < j). 

Clearly, there is a unique mapping / from events x of p to labels a 1 , where I(x) = a 1 iff 
l p (x) = a and l q ((x, 1)) = a\. Using similar reasoning as in the previous case, it follows by 
Lemma 3.3.2 that since p is an interval pomset, there is a linearization v of q such that (the 
unique) a 8 2 -labeled event precedes (the unique) 6^-labeled event in v iff J -1 (a 8 ) < p I -1 (IP). 
Clearly, v £ X>(C[JVi]). If v £ V(C[N 2 ]), let v' be the minimal prefix of v with v' £ V(C[N 2 ]). 
Then there must be some pomset-divergence (p' , {d p >}) of 7 + M (dupl-split([N 2 , Act)) grow {7}) 
such that p' contains no a 2 -labeled events and some (q',{d q i}) £ a'(S'(p')) such that v' is a 
linearization of q' . By the same reasoning as before, we can assume without loss of generality 
that all o^-labeled events in p' are maximal, and d p i contains exactly the a labeled events of 
p for all a £ Act. Clearly, there is a unique mapping I' from events x of p' to labels a 1 , where 
I'(x) = a 1 iff lpi(x) = a and l q i((x,l)) = a\. It is then easy to see that J -1 o I' is a label- 
preserving order- augmenting bijection from p' to a downward- closed subset of p. Furthermore, 
for all x £ p — J _1 (/'(p')) and all y £ d p , it is easy to see that the J'(y) 2 -labeled event exists 
and is in v', and the l q (x, l)-labeled event is in v — v' . Hence, J _1 (/'(y)) < p x. Furthermore, 
since d p and d p i contain exactly the the a -labeled events of p and p' , respectively, it is easy to 
see that I- l (r(d pl )) C d p , and so I- l {r((p' ,{d p ,}))) C (d,{d p }). But by definition of [-]^ u v ^, 
this would imply that (p, {d p }) £ PD 2 , a contradiction. Thus, v (j£ V(C[N 2 }) after all, and so 
by Proposition 3.1.4, C[iVi] and C[iV2] are MUST-inequivalent, proving this case. 

For the last case, suppose that PDi = PD 2 but PFi 7^ PF 2 ; we assume wlog that there is 
some interval pomset-failure (p, F p ) £ PFi — PF 2 such that (p, {Events p }) £" PDi U PD 2 . Thus, 
(p, F p ) is an augmentation of a pomset-failure (r, F p ) of 7 -\- M ( dupl- split ((iV l7 Act)) grow {7}). 
It is easy to see from the definition of [•] 1 ^f.T that r, and hence p, cannot contain any 7- 
labeled event, while it follows from the definition of WT Nets that r, and hence p, can contain 
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at most one ^/-labeled event. Furthermore, from Lemma 3.2.41, we can assume without loss 
of generality that r, and hence p, does not contain any a 2 labeled events, for any a £ Act. 
Finally, using Proposition 3.2.38, it is easy to see that for all a £ Act, any o^-labeled event 
is maximal in r; thus, we can assume wlog that for all a £ Act, all o^-labeled events are 
also maximal in p. Let Act 1 , a, 8, and C[-] be as in the previous case. Furthermore, let 
n = | Event s p |, and let 8' be the sequence (choice( aoa i i a ™y. a £ Act — {y/}) followed by the 
sequence (choice^ ai a i _...„») : a £ Act— {y/}) followed by choicer /nny We let a' be as in 
the previous cases. It is easy to see that there is some pomset q £ a'(8'(p)) such that all 
labels in q are distinct and {q,F q ) is an augmentation of a pomset-failure of C[iVi], where 
F q = {a\ : a £ F p } U ({7, V/ fl F p ). Furthermore, in q all a -labeled events of p have been 
"fully split," while all o^-labeled events of p have been "half-split." Again, since we implicitly 
equate isomorphic pomsets, we can assume that q has the same form as in the previous case. 

Clearly, there is a unique mapping / from events x of p to labels a 1 , where I(x) = a 1 iff 
l p (x) = a and l q ((x, 1)) = a\. Using similar reasoning as in the previous case, it follows by 
Lemma 3.3.2 that since p is an interval pomset, there is a linearization v of q such that (the 
unique) a 8 2 -labeled event precedes (the unique) 6^-labeled event in v iff I -1 (a 1 ) < p J _1 (6 J ). 
Clearly, {v,F q ) £ .F(C[iVi]). If v £ V(C[N 2 ]), then it is easy to show by the same reasoning 
as the previous case that (p, {Events^}) £ PD 2 , a contradiction. Thus, if {v,F q ) £ T{C[N 2 ]) 
there would be some pomset-failure (p',F p >) of 7 -\- M (dupl-spUt((N 2 , Act)) grow {7}); and some 
q' £ cr'(8'(p')) such that v' is a linearization of q' and F q C {a{ : a £ F p i} U ({~f,y/} fl F p i). 
Clearly, there is a unique mapping I 1 from events x of p' to labels a% where I'(x) = a 1 iff 
l p i(x) = a and l q i((x, 1)) = a\. It is then easy to see that J -1 o I' is a label-preserving order- 
augmenting bijection from p' to p. Furthermore, it is easy to see that F p C F p i . But by 
definition of pomset-failures and [•] 1 ^f.T, this would imply that {p,F p ) £ PF 2 , a contradiction. 
Thus, {v,F q ) £ T{C[N 2 ]) after all, and so by Proposition 3.1.4, Cf^] and C[N 2 ] are MUST- 
inequivalent , proving this case and the theorem. ■ 

We now observe that the [•] MAY ,['l^ut S -7> an d [-l™;^ semantics make strictly more dis- 
tinctions than the [•] 1 ^ t A 7 Y ,[-] 1 ^ t ^I, and l/]™^ semantics, respectively, and hence are not fully 
abstract: 

Theorem 3.3.12 The [-] MAY , Hfjl^ and [-]™ ; ^ semantics are respectively not fully abstract 
for MAY-equivalence, MUST-equivalence, and Testing-equivalence with respect to the WT Net 
operators. 

Proof. Let JVi and N 2 be the nets pictured in Figure 3-8, let Act = {a, 6}, and let p be 
the pomset pictured in Figure 3-8. It is straightforward to show that (Ni,Act) -\- M (N 2 ,Act) 
and (N 2 ,Act) have equivalent 1/]™^ meanings. However, they have different [-] MAY mean- 
ings, since p is a non-interval pomset-trace of (Ni,Act) but not of (N 2 ,Act). Furthermore, 
they have different [-]fy t s .?! meanings, since (p[/],0), where f(a) = a and f(b) = b , is a non- 
interval pomset-failure of the 7 -\- M dupl- split version of (Ni, Act) -\- M {N 2 , Act) but not of the 
7 +m dupl- split version of (N 2 ,Act). Thus, it is an immediate consequence of Theorem 3.3.11 
and the definitions of the semantics that [[-] MAY , [•]^u t s I, and H/]™^.- cannot be fully abstract. ■ 

In addition to process equivalence under experiments, Hennessy [19] presents a natural form 
of MAY-, MUST-, or Testing- approximation, in which a process, p, is said to MAY-approximate 
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p = a a 

Figure 3-8: Interval Example 

(MUST-approximate) a process, q, iff g may (must) pass every experiment that p may (must) 
pass, but not necessarily the converse. Our J-]?^, ['E^-to an( i H™^ semantics are, in 
fact, also fully abstract with respect to MAY-, MUST-, or Testing- approximation, where the 
['EttT semantics is ordered by set-theoretic containment of the pomset-traces, and the [•] 1 ^f.T 
semantics is ordered by component-wise reverse containment of the pomset-failures and pomset- 
divergences. These orderings will be presented in detail in Chapter 4. The proofs of full 
abstraction for process approximation are identical to the proof of 3.3.11. 
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Chapter 4 

The Semantic Domains 



In this chapter, we show that all the semantics presented in Chapter 3 map WT Nets to 
elements of complete partial orders (cpo's) and and that all our process operations correspond 
to continuous functions on these cpo's. In order to prove these properties, we give an abstract 
characterization of each of our spaces of process meanings. These results together provide a 
semantic foundation for inductive (fixed-point) reasoning about recursively- defined processes in 
the standard manner (c/. [18, 19]). 

We also prove in this chapter that all our semantic domains are algebraic cpo's, in the sense 
that all elements are fully determined by the compact (finitely-specified) elements that approx- 
imate them. Furthermore, all compact elements of these cpo's are definable as the meanings of 
WT Nets. These results, although technically rather hard, are important because they guaran- 
tee that our full abstraction results from Chapter 3 will continue to hold for recursively- defined 
processes. 

4.1 Standard Definitions 

We begin with some standard definitions about algebraic complete partial orders and continuous 
functions, c/., [18, 19]. 

Definition 4.1.1 A partial orderis a pair (X>, C-p), where V is a set and C-p is a binary relation 
on V that is reflexive, anti-symmetric, and transitive. 

A element x £ V is the least element of V iff a; C-p y for every y £ V. Let A be a subset 
of V and x an element of A. Then x is an upper bound of A iff y C-p x for every y £ A. We 
say that a; is a least upper bound of A iff, in addition, x C-p z for every upper bound z of A. It 
follows from the anti-symmetry of C-p that least upper bounds, if they exist, are unique. We 
use \_\ v A to denote the least upper bound of A, when it exists. 

A is a directed subset of V iff it is non-empty and for all pairs of elements Xi,x 2 £ A, there 
is some x 3 £ A such that x 3 is an upper bound of the set {xi, x 2 }. 

The partial order (V, Q-p) 1S a complete partial order (cpo) iff it has a least element and 
every directed subset of V has a least upper bound. 

An element x £ V is compact iff for every directed set A C V such that x C p |J A, there 
is some y £ A with x C p y. A cpo (V, Q-p) 1S algebraic iff for every element z £ V, the set 
M z = {x £ V : x is compact and x C p z} is directed and z = \_\ M z . 

79 
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Definition 4.1.2 Let {T>,\Z V ) and (E, Q £ ) be cpo's and let / be a function from V to E. 
Then / is continuous iff for every directed subset A C V, f(A) is a directed subset of E and 
f(UvA) = Uef(A). 

Definition 4.1.3 Let (V, Q-p) be a cpo and let / : V—*V be a function. An element x £ V is 
called a /jaiec? point of / iff a; = /(a;). It is called the least fixed point if, in addition, x C p y for 
every fixed point y of /. 

The following well-known theorem ensures that complete partial orders and continuous 
functions support fixed point reasoning about recursively- defined processes, c/., [18, 19] for the 
proof. 

Theorem 4.1.4 (standard) Let (V, Q-p) be a cpo and let / : V—*V be a continuous function. 
Then / has a least fixed point (in V). 

4.2 The Unsplit Semantics 

This section gives an abstract characterization of the [-] MAY , [.] MUST 5 and [•] TEST semantics on 
WT Nets, shows that they form algebraic cpo's, and proves that all the corresponding process 
operations from Chapter 3 are continuous functions on these cpo's. 

The following proposition will be useful in proving these properties of our semantic domains: 

Proposition 4.2.1 Let Act be a finite set of labels, let PT be a prefix-closed set of pomset- 
traces over Act, let PF be a prefix-closed set of pomset-failures over Act, and let PD be a 
prefix-closed set of pomset-divergences over Act. Then 



• 



• 



• 



augment( extend Acti P P>)) is prefix-closed and extension-closed over Act. 

augment(PT) is prefix-closed and augment (PF) is prefix- closed. 

If PF D {(p, 0) : (p, D p ) £ PD for some D p }, then 

augment(PF) U implied-failures Art (augment(extendAct(PD))) is prefix- closed. 



Proof. The extension-closure of augment(extendA c t(P D)) is a simple consequence of 
Proposition 3.2.15 and the prefix- closure of PD. To show that augment(extendA c t(P D)) is 
prefix- closed, suppose that (p,D p ) C (q,D q ) ^ (r,D r ), (p,D p ) £ PD, and (r',D r i) is a prefix 
of (r,D r ). By Proposition 3.2.17, there is some prefix (q',D q i) of (q,D q ) such that (q',D q i) ■< 
(r',D r i). It is then a simple consequence of Proposition 3.2.17 and the prefix- closure of PD 
that (r',D r i) £ augment(extendA c t(PD)). 

The prefix- closure of augment(PT) and of augment(PF) follows immediately from Propo- 
sition 3.2.17 and the prefix- closure of PT and PF. 

For the last part of the proof, let (r,F) £ imptied-failures Aci (augment(extendAct(PD))) and 
let r' be a prefix of r. Thus, there is some (p,D p ) £ PD and some (q,D q ) with (p,D p ) C 
(<liDq) ^ ( r ? {Events,,}), and we can assume without loss of generality that D q = {Events^}. 
Let q' be the restriction of q to r'; it is easy to see that q' is a prefix of q and q' ■< r'. If q' is a 
prefix of p, then (p, 0) £ P_F and the prefix- closure of PF imply that (q, 0) £ PF, and so (r, 0) £ 
augment(PF). For the other case, when q' is not a prefix of p, it follows by Proposition 3.2.17 
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that (p',D p >) Q (g', {Events^/}) ■< (r' , {Events r <}) for some prefix (p',D p >) of (p,D p ). Thus, it 
follows from the prefix-closure of PD that (r', 0) G impUed-failures Art (augment( extend ^ ci (PP))), 
completing the proof. ■ 

We now give the abstract characterizations of the [-] MAY , [-] MUST 7 and [•] TEST semantics. 

Definition 4.2.2 Let Act be a finite set of labels containing the distinguished symbol y/. A 
pair {PT, Act) is said to be MAY-respecting iff PT is a set of pomset-traces over Act such that 

1. G PT. 

2. PT is prefix- closed. 

3. PT is augmentation- closed. 

4. p G PT and p contains a ^/-labeled event implies that there is exactly one such event and 
this event is the unique maximum event of p. 

Definition 4.2.3 Let Act be a finite set of labels containing the distinguished symbol y/. A 
triple (PF,PD,Act) is said to be MUST-respecting iff PF is a set of pomset-failures over Act 
and PD is a set of pomset-divergences over Act such that the following properties hold: 

1. Closure properties of PF: 

(a) (0,0) ePF. 

(b) PF is prefix- closed. 

(c) PF is augmentation- closed. 

(d) (p, F) G PF and F' C F implies that (p, F 1 ) G PF. 

(e) (p, F) G PF, c G Act, and (p; c, 0) G - PF implies that (p, F U {c}) G PF. 

2. Closure properties of PD: 

(a) PP is prefix- closed. 

(b) PD is augmentation- closed. 

(c) PD is extension-closed under pomset-divergences over Act. 

(d) if (p , D) G P-D, fi, • • • , r k are downward- closed subsets of p , and for all n > 0, 
there is some p n+ i with (p n +i 5 -D) G P-D and some {xi, . . ., x k } C max(p n+ i) 
such that p n+ i — {xi, . . ., x k } = p n and r, = down Pn+1 (xi) for 1 < i < &, 

then (p ,D\j{ ri ,...,r k }) G PP. 

(e) (p,D) G min\z{PD) implies that p contains no -^/-labeled events. 

3. Mixed closure properties: 

(a) (p, F) G PF and (p, {Events^}) (j£ PD and p contains a -^/-labeled event implies that 
there is exactly one such event, this event is the unique maximum event of p, and 
(p, Act) G PF. 
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(b) {p,D) G PD and P C Act implies that {p,F) G PF. 

(c) if (po 5 0) G -P-f 1 , r i i ■ ■ ■ i r k are downward- closed subsets of p , and for all n > 0, 
there is some (p n +i 5 0) G -P-f 1 an d some {x,, . . ., s fc } C max(p n+ i) 

such that p n+ i — {xi, . . . , s fc } = p n and r, = down Pn+1 (xi) for 1 < i < A;, 
then {p ,{r 1 ,...,r k }} G PP. 

We remark that closure conditions (2d) and (3c) are necessary and sufficient to ensure that 
unbounded concurrency in PF or PD is possible only in the presence of appropriate causal 
divergences, which themselves may be concurrent. 

Definition 4.2.4 Let Act be a finite set of labels containing the distinguished symbol y/. A 
pair ((PT,Act},(PF,PD,Act}} is said to be TEST-respecting iff (PT,Act} is MAY-respecting , 
(PF,PD,Act) is MUST-respecting , and 

1. p £ PT implies that (p, 0) G PF. 

2. {p, F) G PF and {p, {Events^}) ^ PD implies that p G PP. 

3. {p,D) G min\z{PD) implies that p G PP. 

Definition 4.2.5 Let Act be a finite set of labels containing the distinguished symbol y/. 
Then P^ t Y is defined to be the set of all MAY-respecting pairs (PT,Act). Furthermore, 
C^ c A t Y is the binary relation on V™% such that for every (PT u Act) and (PT 2 ,Act) in P^ c A t Y , 
(PT 1 ,Act)C : ^(PT 2 ,Act) iff PPi C PT 2 . 

Definition 4.2.6 Let Act be a finite set of labels containing the distinguished symbol y/. Then 
V^ t ST is defined to be the set of all MUST-respecting triples {PF, PD, Act). Furthermore, Q^ t ST 
is the binary relation on T>^ t ST such that for every (PFi,PDi,Act) and (PF 2 ,PD 2 ,Act) in 
p must 5 (p Fu p Du Act)Q™ v ct ST (PF 2 ,PD 2 ,Act) iff PF, D PF 2 and PP : D PP 2 . 

Definition 4.2.7 Let ^4c£ be a finite set of labels containing the distinguished symbol y/. 
Then P™ t ST is defined to be the set of all TEST-respecting pairs ((PT, Act),(PF, PD, Act}}. 
Furthermore, C™j T is the binary relation on P™* ST such that for every (ai,fii) and (a 2 ,(3 2 } in 
VYJ\ <«i,/3i)E^ s > 2 ,/3 2 ) iff«!EZ Y «2 and ^T^- 

We first show that [-] MAY , [.] MUST , and [-] TEST map WT Nets to elements of P^ C AY , P^ c u t ST , 
and P™ t ST , respectively. 

Theorem 4.2.8 Let (N,Act) be a WT Net. Then {(N, Act}j MAY G P^ A t Y , {(N, Act}j MVST G 

P^ c u t ST , and l(N,Act}j TEST G V 



TEST 
Act ■ 



Proof. The proof for [-] MAY is a simple consequence of Definition 2.1.2, the definition of 
pomset-traces, Proposition 3.2.14, and Proposition 4.2.1; the details are left to the reader. 

For the proof of [-] MUST , let (PF N ,PD N ,Act} = {(N, Act}] MVST . All the closure conditions 
in Definition 4.2.6 except for (2d) and (3c) follow directly from the definition of |.J MUST 5 the 
definition of WT Nets, Proposition 3.2.14, Proposition 3.2.15, and Lemma 4.2.1. 

To prove that closure condition (2d) holds, let some sequence ((p n , D} : n > 0) and some set 
R of prefixes of p be given that satisfy the hypothesis of (2d). For one case, suppose that all of 
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the (p n , D) G augment(pomset-divergences((N, Act))). We recall that by definition of WT Nets, 
only a finite number of transitions are enabled under any reachable marking of (JV, Act). Thus, 
it is possible for an unbounded number of concurrent events to be enabled after any prefix r of 
p only if either a divergence is enabled immediately after r or a divergence is enabled "along 
the way to r," i.e., immediately after some pomset r' with (r', {Events,,/}) C (r, {Events,,}). In 
either case, it then follows easily from the definition of pomset-divergences that {po,D U R) G 
PD N . 

For the other case, Proposition 3.2.14 and Proposition 3.2.15 imply that there is some se- 
quence ((q n ,D n ): n > 0) such that every {q n ,D n ) G augment(pomset-divergences((N,Act))) 
and {q n ,D n ) C (p n ,D). Since by Proposition 3.2.14 and Proposition 3.2.17, 
augment(pomset-divergences((N,Act))) is prefix- closed, we can assume without loss of gener- 
ality that for all n > 0, there is no event x G q n such that down qn (x) D d for some d G D n . 
Furthermore, since by hypothesis all events in p n —p are maximal in p n , we can assume without 
loss of generality that every D n is a non-empty set of prefixes of p . Thus, there are only a 
finite number of distinct D n , and hence there is some subsequence {{q nk , Dn k ) '■ k > 0) such that 
all the D„ k are equal to some non-empty set D'. If there is some x G Po an d some q n . such 
that x is not an event of q n . , there must be some d G D' with d C down Po (x); therefore, by our 
assumptions on the q n , it follows that x is not an event of any of the q„ k . We then have that 
for ah n k , the set Events gre n Events Po is identical. Furthermore, for every x, G (p n — Po) — ( in ■, 
there must be some d G D' with d C down Pn .(xi) = r, for some r,- G R. Thus, it follows 
by our assumptions on the q n that x, is not an event of any of the q„ k . Furthermore, since 
augment(pomset-divergences((N,Act))) is prefix- closed, we can assume without loss of gener- 
ality that q no is a prefix of p and that for all i > 0, q n , +1 — x = q„ t for some x G max(q ni ). 

It is now easy to see that either (i) all of the q„ k are identical and are equal to some pomset 
q that is a prefix of p , and for every r,- G R, there is some d G D' with d C r,- or (ii) there is 
some R' C R such that R' and the sequence ((q nk ,D') : k > 0) satisfy the hypothesis of (2d), 
and for all r,- G i? — i?', there is some d £ D' with rfC r,-. If (i) holds, it follows easily by our 
construction of the {q„ k , Dn k ) that (q, D') C (p,DU R). If (ii) holds, it follows from the earlier 
case in this proof that (q no ,D' U R') G PD N . It follows from the construction of the q„ k that 
(q no ,D' U R') Q {po,D U R), proving this case. 

The proof of closure condition (3c) is quite similar and is left to the reader. 

For the proof of [-] TEST , it is straightforward to see from the definitions of pomset-traces, 
pomset-failures, and pomset-divergences of WT Nets, the definition of [-] TEST , and Proposi- 
tion 3.2.15 that the additional closure conditions hold. The proof of this case then follows 
easily from the previous cases. ■ 

We now observe that: 



Theorem 4.2.9 Let Act be a finite set of labels containing the distinguished symbol yj . Then 

1MAY l— MAY\ /7-)MUST |— MUST\ i /-T-jTEST |— TES: 

'Act i—Act h \ u Act i—Act h dllu \ u Act i —Act 



(V^, EZ Y >, (^Z ST , EZ ST >, and (P™ s t, E^ ST ) are complete partial orders. 



Proof. It is easy to see that (V%£ , C^ Y ), (V*™ , C^ t ST ), and (V™? , C™f ) are partial 
orders. 

For T>^^ , it follows immediately from the definition of MAY-respecting and T>^^ that 
{9, Act) G V^ and approximates every element {PT,Y) G V^ with S = Act. Let A 
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be a directed subset of P^ Y , and let {(PTi,Act) : i > 0} = A. It is very easy to see that 
([j{ PT i ■ i > 0},Act) £ V^ , proving this case. 

For the proof of V^ t ST , let PF% ct be the set of all pomset-failures over Act, and let PD^ ct be 
the set of all pomset-divergences over Act. It is easy to see that {P F Act , P D^ ct , Act) £ 2?^ ST 
and approximates every element (PF,PD,T,) £ X'^ ST with X = ^4cf. 

We now show that every directed subset A of ^^ t ST has a least upper bound in V^ t ST . 

Let {{PFi,PDi,Act) :i>0} d = A, let PF A = fl{^ : i > 0}, and let PD A = fll^A : i > 0}. 
Clearly, it suffices to show that (PF A ,PD A ,Act) £ V^ t ST . All the closure properties follow 
trivially, except for (le), (2e), and (3a). 

(le) (p, F) £ PF A , c £ Act, and (p; c, 0) £" PF A implies that (p, F U {c}) £ PF A . 

(2e) (p, P) £ min\z{PD A ) for some P implies that p contains no ^/-labeled or 7-labeled events. 

(3a) (p,F) £ PF A and (p, {Events^}) £" P-D^ and p contains a ^/-labeled event implies that 
there is exactly one such event, this event is the unique maximum event of p, and (p, Act) £ 
PF A . 

To prove (le), suppose for the sake of contradiction that for some c £ Act, (p,F) £ PF A , 
(p; c, 0) £ PF A , and (p, PU {c}) £" PF A . Then (p, P) £ PP for all (PP, PD { , Act) £ A, (p, PU 
{c}) £" PP m for some (PF m ,PD m , Act) £ A, and {p;c,9) £ PFj for some (PFj,PDj, Act) £ 
A. Since A is a directed set, there would be some (PF k ,PD k ,Act) £ A that is an upper 
bound of both (PF m ,PD m , Act) and {PF h PD h Act). This would imply that (p,F) £ PF k , 
(p,PU {c}) £ PP fc , and (p;c,$) £" PF k , a contradiction since (PF k ,PD k ,Act) e AC V^ t ST . 
Thus, (le) must hold after all for PF A . 

To prove (2e), it suffices to show that (p, D) £ min\z{PD A ) implies that (p, D) £ min\z(PDj) 
for some (PFj,PDj,Act) £ Act. Clearly, there are only a finite number of distinct pomset- 
divergences (pi,Di) with (pi,Di) \Z (p,D), and PD A does not contain any of them. Hence 
for every such (pj,Pj), there is some (PFi,PDi,Act) £ A such that (pi,Di) £" PD,. By 
compactness, there is then some (PFj,PDj,Act) £ A with (p,D) £ min\z(PDj). 

The proof of (3a) is very similar and is left to the reader. 

The proof for P™ t ST is a straightforward combination and adaptation of the proofs of the 
previous two cases. The details are left to the reader. ■ 

We now give a finite characterization of the compact elements of these domains: 

Definition 4.2.10 Let Act be a finite set of labels containing the distinguished symbol y/. A 
pair (PT, Act) is a finite candidate of V^ iff (PT, Act) £ V^ and PT is a finite set. 

A triple (PF,PD,Act) is a finite candidate of T>^ t ST iff Act is a finite set of labels and 
there is some finite set PP"fi n of pomset-failures over Act and some finite set PPfi n of pomset- 
divergences over ^4c£ such that: 

. (pp- fin ,0,^)£pr t ST - 

• PPfin is prefix- closed. 

• {p,D) £ PP fin implies that (p, 0) £ P.F fin . 
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• PD = augment(extendAct('PVfi Il )). 

• PF = PPfi n U implied-failures Act (PD). 

A tuple (a, (3) is a finite candidate of P™t ST iff (a, (3) £ P™ t ST , a is a finite candidate of 
V^, and [1 is a finite candidate of P^ c u t ST . 

Lemma 4.2.11 Let ^4c£ be a finite set of labels containing the distinguished symbol y/. Then 
all finite candidates of Z>^ Y , P^ust , and P™ ST are compact elements of P^ Y , V^ t ST , and 
P™ t ST , respectively. 

Proof. For the proof for P^ c A t Y , let (PT, 4cf) be a finite candidate, and let A C £>^ay be a 
directed set such that (PTjAdjC™ |J^- Since PT is finite, it follows immediately from the 
directedness of A that there is some {PT k , Act) £ A with PT C PT k . 

For the proof for P^ c u t ST , let (PF,PD,Act) be a finite candidate, and let PP fin , PPfin 
be given. We first show that (PF,PD,Act) is in fact an element of V^ t ST . Proposition 4.2. f 
immediately implies that closure conditions (2a), (2b), and (2c) of Definition 4.2.6 hold for PD. 
Proposition 3.2. f 5, the given properties of PPfi n , and the fact that (PPfi n , 0, Act) £ P^ t ST 
immediately imply that closure condition (2e) holds. To show (2d), suppose there is some 
(p n ,D) £ PD for n > and some r\,...,r k satisfying the hypothesis. By definition of PD 
and the finiteness of PPfi n , clearly an infinite number of the (p n , D) must be augmentations of 
extensions of some common (p, D') £ PPfi n such that (p, D' U {r\, . . . , r k }) £ PPfi n . It is then 
easy to show that the other closure properties of PD imply that (po,D U {r l7 . . -,r k }) £ PD; 
the details are left to the reader. The proof of closure condition (3c) for PF is similar. 

From the definition of P^ c u t ST , Proposition 4.2.1, and the fact that {VT^,%,Act) £ P^ c u t ST , 
it is easy to see that all the other closure conditions hold, proving that {PF, PD, Act) £ V^ t ST . 

Let A C P^ust be a directed set such that (PF,PD,Act)\Z^ T (PF A ,PD A ,Act) = \JA. 

Let k = max{\p\ : (p, 0) £ P-Ffi n }, and let m be the number of distinct pomsets in P-Ffi n , 
i.e., m = \{p: (p, 0) £ P-Ffi n }|. Let U be the following set of pomset-failures: 

U = {(p, F) : (p, F) is a pomset-failure over Act, (p, F) $ PF, and \p\ < m ■ 8 k }. 

Clearly, U is finite and does not intersect PF, and hence does not intersect PF A . The 
directedness of A then implies that there is some (PFi,PDi,Act) £ A such that PFi does not 
intersect U. 

To show that PFi C PF, let (r,F r ) be a pomset-failure over Act with (r,F r ) (j£ PF. If 
|r| < m ■ 8 k , then clearly, (r,F r ) (j£ PFi. Otherwise, when \r\ > m ■ 8 k ; we will show that there 
is some prefix r' of r such that \r'\ < m ■ 8 k and (r',0) £" PP. Let g be a prefix of r such 
that (q, 0) £ P.Ffi n , and g is maximal with respect to these properties; clearly, such a pomset q 
exists since by Definition 4.2.10, (0,0) £ PPfi n - Furthermore, by definition of A;, it follows that 

kl ^ k. 

We obtain a prefix r' of r by iterating the following procedure until termination. First set 
r' to be the prefix of r with carrier {x £ Events,, : depth r (x) < k + I}. Pick some x £ r' — q 
such that x is in some cut C of r' of size strictly larger than k + I. If there are A; + I distinct 
Xi, . . .,x k+ i £ (C — {x}) such that for all q' with (g',0) £ PPfi n5 down r i(x) P\ q' = down r i(xi) n 
q 1 = . . . = down r i(x k+ i) n g', then remove from r' the set of events {y £ Events,,* : a; < r y}, and 
re-set r' to be the resulting pomset. Repeat this procedure until there are no events x in r' 
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satisfying the above conditions. Clearly, the resulting pomset r' is a prefix of r. Furthermore, 
since PFfi n contains at most m different pomsets, each of size bounded by k, and each such 
pomset has at most 2 k prefixes, it is easy to see that the size of any cut in r' is bounded by 
m-2 k ■(k + l). Furthermore, since the depth of r' is bounded by k-\-l, it follows that \r'\ < m-8 k . 

It is easy to see by construction of r' that q is a prefix of r' and that r' j^ q; thus (r', 0) £" 
VJ-fin by maximality of q. Suppose for the sake of contradiction that (r', {Events,,/}) £ PD; then 
by Proposition 3.2.15 and the prefix- closure of PPfi n , there is some (p,D p ) £ augment (W^) 
such that (p,D p ) Q (r', {Events,,*}). Thus, Definition 4.2.10 implies that (p, 0) £ PFfi n an d 
hence that \p\ < k. For every y £ r — r' , either (i) there is some x £ r — r' with x < r y, some 
cut C of r' , and some k + 1 distinct x x , . . . , x k+ i £ C such that for all q 1 with (g', 0) £ VJ-fin, 
down r i(x) fl q' = down r i(xi) p\ q' = . . . = down r i(x k+ i) n <?' or (ii) depth r (y) > A; + 1. Suppose 
(i) holds, then since p has concurrency bounded by k, there must be some such x, with x, £" p. 
So, there is some d £ D p with <i C down r i(xi) fl p, and so by hypothesis, down r i(xi) P\ p = 
down r i(x) Pip, and so d C down r i(x) C down r (y). If (ii) holds, then there must be some z £ r 
such that z < r y and depth r (z) = k + 1. If z £ r', then since the depth of p is bounded by 
k, z (j£ p and there is some d £ D p such that <i C down r i(z) C down r (y). If z ^ r', then 
there is some a; < r ^ satisfying the conditions of (i), so there is some d £ D p such that d C 
down r i(x) C down r (z) C down r (y). Thus, (p,D p ) C (r, {Events r }), and so by Definition 4.2.6, 
(r, {Events,,}) £ P-D, a contradiction since {r,F r ) (j£ PF. Hence, {r',{r'}) (j£ PD, and since 
(r 1 , 0) £ PJ^fin, it follows that (r', 0) ^ PF and is thus in U. 

Now, (r, 0) £ PF,- would imply that (r',0) £ PF,-, since PF { is an element of V^ t ST and 
thus prefix- closed. But this would imply that PFi fl U j^ 0, a contradiction. Thus, PF,- C PF. 

We now give the proof for pomset-divergences. Let V be the following set of pomset- 
divergences: 

V = {(p,D p ) : (p,D p ) is a pomset-divergence, (p, D p ) ^ PD, and (p, 0) £ P-Ffi n }. 

Clearly, F is finite and does not intersect PD, and hence does not intersect PD A . The 
directedness of A then implies that there is some {PFj, PDj, Act) £ A such that PDj does not 
intersect V and PFj C PF,- C PF. 

We now show that PDj C PF. Let (r,D r ) be a pomset-divergence over ^4c£ with (r,D r ) £" 
PF. If (r, 0) ^ PF, then (r, 0) ^ PF^, and so {r,D r } £ PDj from the closure properties of 
elements of V^ t ST . If (r, 0) £ PF fin , then (r, D r ) £ V, and so (r, D r ) £ PDj. For the last 
case, we have that (r, 0) £" PFfi n and (r, 0) £ PF. We define an extension (r 1 , {Events,,/}) 
of (r, D r ) as follows: let the carrier of r' be the carrier of r together with some disjoint set 
of events {(d,i) : d £ D r and 1 < i < k + 1}. The ordering and labeling of r' agrees with r 
on events in r, all the new events (d,i) are maximal in r' , and for all (d,i), down r i((d,i)) = 
d. The labels of the (d,i) are arbitrarily chosen to be labels in Act. It is easy to see that 
(r,F r ) E (r', {Events,.,}) and that (r',0) ^ PF fin since (r, 0) ^ PF fin and by Definition 4.2.10, 
P-Ffin is prefix- closed. Suppose for the sake of contradiction that (r', {Events,,,}) £ PD; then by 
Proposition 3.2.15 and the prefix- closure of PPfi n there is some (p', F p ,) £ augment (W^) with 
(p',D p >) \Z {r 1 , {Events,,,}). Since the concurrency in p' is bounded by k, there must be some 
(d, i) £ r' —p' for every d £ F r . Hence, for every d £ D r , there is some <i' £ F p / with d! C rf. Let 
p be p' with all (<i, i) events removed, and let D p = {d 1 £ D p i : d! C p}. Then it is easy to see that 
D p is non-empty, (p,D p ) is a prefix of (p',D p i), and (p,D p ) C (r,D r ). But by Definition 4.2.6, 
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this would imply that (r,D r ) G PD, a contradiction. Hence, (r' , {Events,,*}) G - PD after all, 
and since (r',0) G - P.F fin , it follows that (r',0) G - PF. 

Now (r,D r ) G -P-Dj would imply by the closure properties that (r', {Events r /}) G PDj, and 
hence that (r',0) G P-f}, a contradiction since PFj C PP. Thus, 

{PF.PD.Act^^riPF^PD^Act) G A, 

proving this case. 

The proof for V™f T is a simple consequence of Definition 4.2.7 and the previous two cases. ■ 

Lemma 4.2.12 Let Act be a finite set of labels containing the distinguished symbol y/. For 
every (PT,Act) G V^ , there is a directed set Ai C P^ay of finite can didates of V^ with 
|JAi = (PT,Act). For every (PF,PD,Act) G £>^ u t ST , there is a directed set A 2 C P^ust of 
finite candidates of V^ t ST with |JA 2 = (PF,PD,Act). For every ((PT, Act) , (PF, PD , Act)) G 
VYJ T , there is a directed set A 3 C £>™ ST of finite can didates of £>™ ST with [J A 3 = 
((PT,Act),(PF,PD,Act)). 

Proof. We first give the proof for V™^ ■ For every n > 0, we define the ra th approximation, 

(PT n ,Act), to (PT,Act) as follows: 

PT n = {p G PT : M < n} 

We recall that by definition of V^^ , Act is finite. It is then easy to see that each {PT n , Act) 
is a finite candidate, each (PT n ,Act)C.^^(PT,Act), and that the (PT n ,Act) form a chain in 
V™% . Thus, Ui(PT n , Act) : ra > 0}Q™^ (PT,Act). For the other direction, let p G PT; then 
p G PP| P |, proving this case. 

We now prove the case for V^ t ST . For every n > 0, we define ra th approximation, 
(PF n ,PD n ,Act), to (PF,PD,Act) as follows. The idea is that each ra th approximation is 
generated by the set of pomset-failures and pomset-divergences in PF and PD whose depth 
is bounded by n. However, PF and PD may have unbounded concurrency and hence may an 
infinite number of pomsets of any given depth n. In order to ensure that each VJ-an- n and 
P^fin-n are finite, we use only the minimal elements of PF and PD; in order to ensure that 
VJ-fin and PPfin satisfy the conditions in Definition 4.2.6, we close under prefixing. 

Since we want the resulting finite candidates to approximate (PF,PD,Act), we need to 
ensure that all pomset-failures and pomset-divergences in PF and PD are generated by the 
augmentation and extension closure of PJT fin and PX>fi n . Thus, in VJ-fin and PX>fi n , we extend 
past all pomsets of depth equal to n by throwing in all failure sets and throwing in all divergences 
that causally follow any chain of length of n. 



PF' = {(p, F) G PF : p is a prefix of some q such that (q, 0) G PF, 

and either (q, {Events^}) G - PD or {q,D) G min\z{PD) for some D} 

VFfin-n = augment({(p, F) G PF' : depth(p) < n} 

U {{p, F) : (p, 0) G PF', depth(p) = n, and F C Act}) 
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VV^-n = {{p, DUD'): (p, 0) £ VT^. n , P U P' ^ 0, P' C {rfoTO p (a;) U {x} : depth p (x) = n}, 

and either (p, D) e PD or D = 0} 

PP n = augment(extendAct('PVfi Il - n )) 

PF n = VJ-fin-n U implied-failures Act (PD n ) 

We first show that (PF n ,PD n ,Act) is a finite candidate, recalling that by Definition 4.2.6, 
^4c£ is finite. Therefore, an infinite number of distinct (p,, 0) £ P^fin-n would imply unbounded 
concurrency in V 'J-im-n ? an d so the closure conditions (2d) and (3c) of Definition 4.2.6 would 
immediately contradict the definitions of PF 1 and PPfi n - n . Thus, PPfi n - n must be finite. 
We now show that (PPfi n _ n , 0, ^4c£) £ V^ t ST . It follows easily from the closure conditions 
of PF and Proposition 4.2.1 that closure conditions (la) — (Id) hold for VT^ n . For closure 
condition (le), suppose that {r,F) £ T > J r fi_ Il . n and c £ Act and (r, P U {c}) £" VT^ n . Then 
r y p of some {p,F) £ PP' with depth(p) < n. Since (r,FU {c}) £" PPfi n - n , it is easy 
to see that (p, P U {c}) £" PPfi n -ra and depth(p) < n. Furthermore, the closure conditions 
of PF,PD and the definition of PF' imply that (p, F) £ PF and (p, F U {c}) £" PP, and 
hence that (p, {Events^}) £" PP. Moreover, the closure condition (le) on PF implies that 
(p; c, 0) £ PP. Clearly, p;c ■< r;c and since depth(p) < n, it follows that depth(p;c) < n. 
If (p; c, 0) £" PP', then by Proposition 3.2.15 and the definition of PF', there must be some 
(q,D q ) £ min\z{PD) such that q j^ p;c and (q,D q ) \Z (p; c, {Events p;c }). Hence g is a prefix of 
p, and so (q,D q ) C (p, {Events^}), implying that (p, {Events^}) £ PP, a contradiction. Thus, 
(p; c, 0) £ PF' , from which it is clear that (r; c, 0) £ VJ-an- n . 

It follows easily from the prefix- closure of PD and the prefix- closure of VJ-an- n that PPfi n _ n 
is also prefix- closed. The construction of (PF n ,PD n ,Act) then immediately implies that it 
satisfies Definition 4.2.10 and hence is a finite candidate. 

We now show that {PF n ,PD n ,Act)n}fJ T {PF,PD,Act). Let (q,D q ) £ PD, and using 
Proposition 3.2.15 and the prefix- closure of PD, let (r,D r ) £ min\z{PD) such that (r,D r ) C 
(q,D q ). Then (r,D r ) £ PP'. If depth(r) < n, then clearly, (r,D r ) £ PP n and hence so is 
(q,D q ). If depth(r) > n, let r' be the (necessarily unique) maximal prefix of r of depth n and 
let D r , = {d £ D r : d! C r'}. By the closure conditions of PF and PP, (r',0) £ PF and 
(r',D r >) £ PP if P r / is non-empty. For one case, suppose that P r < is non-empty. Then by 
Proposition 3.2.15, there is some (r",P r //) £ min\z{PD) such that (r",P r //) C (r',P r /), and 
so it is easy to see by the prefix- closure of PF and the definition of VJ-an- n that (r",0) £ 
P.Ffi n -n- It is easy to show that (r",D r n U {down r n(x) U {a;} : depth r ,,(x) = n}) £ PPfi n _ n and 
(r" , D r n U{down r >>(x)U{x} : depth r ,,{x) = n}) C (r', P r / U{<iou7n r '(a;)U{a;} : depth r ,(x) = n}) C 
(r,D r ) C (q,D q ), so (q,D q ) £ PD n . The details are simple and are left to the reader, as is the 
other case, which is similar. Thus, PD C PD n . 

To show that PP C PP n , let (q,F) £ PP. If (g, {Events,}) £ PD, then (g, {Events,}) £ 
PD n , and hence (q,F) £ PP n . Otherwise, (q,F) £ PP'. For one case, if depth(q) < n, 
it is clear that {q,F) £ PF n . For the other case, using a proof similar to that for pomset- 
divergences, it is easy to show that (q, {Events,}) £ PD n , and hence (q,F) £ PF n ; the details 
are straightforward and are left to the reader. Thus, (PF n ,PD n , Act)\Z^ T (PF,PD, Act). 
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To show that the set of n th - approximations forms a directed set, we show that for every 
n > 0, (PF n ,PD n ,Act)QTJ T (PFn+i,PD n+1 ,Act). Let (q,D q ) £ PD n+1 ; then (q,D q ) is 
an augmentation of an extension of some (r,D r ) £ PDg n .„ + i . For one case, suppose that 
depth(r) < n. Then it is easy to see that (r,D r ) £ PD, so (r,D r ) £ PD n by the earlier proof, 
and therefore so is (q, D q ). The proof of the other case, when depth(r) = n + 1, is very similar 
to the proof that PD D PD n , and the details are left to the reader. Thus, PD n+ i C PD n . 

To show that PF n+1 C PF n , let {q,F) £ PF n+1 . If (q, {Events J) £ PD n+1 , then by the 
above case, (q, {Events^}) £ PD n , and hence {q,F) £ PP n . Otherwise, if depth(q) < n, it is 
clear that (q, F) £ PF n . For the other case, using a proof similar to that for pomset-divergences, 
it is easy to show that (q, {Events^}) £ PD n , and hence that {q,F) £ PF n ; the details are left 
to the reader. Thus, (PF n ,PD n ,Act)C : ^ t ST (PF n+1 ,PD n+1 ,Act). 

For the last part of the proof, we show that {PF, PD, Act) = \J{{PF„,PD n ,Act) : n > 0}. 
One direction follows immediately from the fact that every {PF n ,PD n ,Act)C : 1 f t !J ;T {PF, PD, Act). 
For the other direction, let (p,D p ) £ f]{PD n : n > 0}, and let k = depth(p). Then (p,D p ) £ 
PD k+ i implies that (p,D p ) is an augmentation of an extension of some (q,D q ) £ P_Dfi n _ fc+1 . 
Since augmentation and extension only increase depth, depth(q) < k, from which it is easy 
to see that (q,D q ) £ PD and hence that (p,D p ) £ PD. For the other case, let {p,F) £ 
f]{ PF n ■ n > 0}, and let k = depth(p). Then (p,F) £ PF k+1 implies that (p, F) £ P-Ffm-ib+i 
or (p, {EventSp}) £ PD k+1 , both of which imply that (p, F) £ PP. Thus, (PF,PD,Act) = 
\_\{(PF n , PD n , Act) : ra > 0}, proving this case. 

We now prove the case for V™f T . For every 1 < n < m, we define the (n,m) approxi- 
mation, {PF (n<m) ,PD n ,Act) to (PF,PD,Act) as follows. First, PF' ,W^. n ,PD n are defined 
as in the proof of the above case. Furthermore, in order to appropriately define the approx- 
imate pomset-traces, we may also need to replace some non-maximal pomsets of depth n in 
PF — PF' . Since we only want to construct finite sets of pomset-traces, we define the (n, m) 
approximation by replacing all such pomsets of depth bounded by n and size bounded by m. 
The formal definitions are as follows: 

P^fin-fn, m) = PPfin-n U augment ( {{p, F) £ PF: p £ PT, depth(p) < n and |p| < to}) 
PF (nim) = {p: (p,0) £ PPfi n _( n , m )} 
PF(n, m ) = PPfin-( n ,m) U implied- failures Act (P 'D '„) 



The proof is a straightforward combination and adaptation of the proofs of the above cases; 
the details are left to the reader. ■ 

We now have: 

Theorem 4.2.13 Let Act be a finite set of labels containing the distinguished symbol y/. Then 
V™%, V^ t ST , and P™st are algebraic cpo > s . 

The theorem is a simple consequence of the definition of compact elements, Lemma 4.2.11, 
and Lemma 4.2.12 (cf. [18]). 
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We now show that all compact elements are definable as the [-] MAY meanings of WT Nets: 

Theorem 4.2.14 Let Act be a finite set of labels containing the distinguished symbol y/. For 
every compact element {PT, Act) G V^ , there is some WT Net (JV, Act) with [(JV, Act)j MAY = 
(PT,Act). 

Proof. Let (PT,Act) be a compact element of V™^ • As a simple consequence of 
Lemma 4.2.12 and the definition of compactness (c/. [18]), (PT,Act) is a finite candidate of 
V^t . Thus, PT is finite set of pomsets over Act. 

We first build a tree whose nodes are labeled with valid pairs of the form (p,x p ), where 
p G PT and x p G max(p) whenever p is non-empty and x p =• otherwise. We use * as a 
wildcard character. 

The tree is recursively built as follows. The root node is labeled (0,«). A node labeled 
(p, *) has an arc to a node labeled with some valid pair (p',x p i) iff p' — x p i = p. Since PT is 
prefix-closed, it is easy to see inductively that there is some (p, *)-labeled node in the tree for 
every p G PT. Furthermore, it is easy to see that the tree is finite, and hence is also finitely- 
branching. Since every pomset implicitly represents its isomorphism class, we assume without 
loss of generality that any two children of any given node of the tree will have distinct second 
components in their labels, i.e., if the labels of the children are respectively (*,x) and (*,?/), 
then x and y are distinct symbols. 

From this tree, we will recursively construct a loop-free net N in which every place has 
in-degree of at most one. This net preserves concurrency of events occurring within any branch 
of the tree; however, events on different branches of the tree will always be represented as 
conflicting transitions. 

We now recursively construct the following net from the tree, level by level. For the first 
level, we begin with a net with one place, which is initially marked. For every child s of the 
root, we add to the net a new / p (a;)-labeled transition, named s, where the label of node s in 
the tree is {p,x). The single initially marked place is attached as the pre-set of each transition 
s. All of these transitions have empty post-sets. 

For the induction step, we show how to define the (k + l)-level of the tree from the &-level 
segment of the tree. For every node s in the k th level of the tree and each child s' of node s, 
we construct a new / p <(V)-labeled transition, named s' , where the label of node s' in the tree is 
(p',x'). 

It is easy to see that for every maximal cause x G Events p < of x' , there is a unique {*,x)- 
labeled node s" along the path from the root to s' . We then hook up transition s' to the 
(already existing) transition s". This is accomplished by creating a new, unmarked place for 
transition s" and adding it both to the post-set of transition s" and to the pre-set of transition 
s' . If x' G min(p'), then a new initially marked place is added to the net and is attached as the 
preset of transition s' . Finally, transition s' is placed in conflict with every transition v in the 
net such that node v is not a predecessor of s' in the tree. This is accomplished by creating 
a new, initially marked place for every such transition v, and putting this new place in the 
pre-sets of both transition s' and v. 

It is then straightforward to show inductively that PT is the set of pomset-traces of the 
net; the details are left to the reader. 

Let Act be the alphabet of the net; clearly, all transitions of the net have labels from Act. 
Since the original tree is finite, an inductive argument shows that the net is 1-safe, has a finite 
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number of initially marked places, and that all places and transitions have finite in-degree and 
out-degree. Thus, only a finite number of transitions are enabled under any reachable marking 
of the net. However, one complication is that the ^/-labeled transitions of N may not clean out 
all the tokens in the net. To correct this, we first recall that any pomset in PT can contain 
at most one ^/-labeled event, which must be the sole maximum event in the pomset. We then 
observe that any ^/-labeled transition, s, in the net, is thus enabled only after firing exactly the 
transitions corresponding to each of the predecessors of node s in the tree. By construction of 
the net, these transitions can only be fired in a sequence that is consistent with the ordering of 
the pomset corresponding to the node s. By Theorem 3.2.3, every such firing sequence results 
in the same final marking; thus, there is exactly one reachable marking of the net under which 
transition s is enabled. A simple modification of the preset of each ^/-labeled transition to 
include all such corresponding marked places then yields the desired WT Net. ■ 

We now show that all compact elements are definable as the |.J MUST meanings of WT Nets: 

Theorem 4.2.15 Let Act be a finite set of labels containing the distinguished symbol y/. 
For every compact element (PF,PD,Act) G V^ t ST , there is some WT Net {N,Act) with 
l(N,Act)] MVST = (PF,PD,Act). 

Proof. Let (PF,PD,Act) be a compact element of V^ t ST . As a simple consequence of 
Lemma 4.2.12 and the definition of compactness (c/. [18]), (PF,PD,Act) is a finite candidate 
of V™ct ST • By Definition 4.2.10, Act is a finite set of labels and there is some finite set VJ-fin of 
pomset-failures over Act and some finite set W^ of pomset-divergences over Act such that: 

. (pj fin ,0,id) e nr- 

• PPfm is prefix- closed. 

• (p,D) G PP fi n implies that (p, 0) G VT^. 

• PD = augment(extendAct('PVfi Il )). 

• PF = VTftn U implied-failures Art (PD). 

We first build a tree whose nodes are labeled with valid triples of the form (p,D p ,x p ) or 
(p,F p ,x p ), where (p,D p ) G VD^ or {p,F p ) G VT^, respectively, and x p G max(p) whenever 
p is non-empty and x p =• otherwise. Furthermore, we require that F p = F 1 — A for some F' 
and A such that (p, F'} G VT^, (p, F' U {c}) G - VT^ for all c G Act -F', C A C Act, and 
for every a G A, there is some p' a G p with a such that (p' a , 0) G P-^fin- We use * as a wildcard 
character. 

The tree is recursively built as follows. The root node is labeled (0, Act — init{VT^a), •). 
A node v labeled (p,F p ,x p ) has an a-labeled arc to a node labeled with some valid triple 
(p 1 , F p i, x p i) or (p' ,D p i,x p i) iff (i) a G Act—F p , (ii) / p <(ay) = a, (iii) p — ay = p, and (iv) for 
every ancestor w of v, if (q, F q , *) is the label of w, then either down p i(x p i) <£. q or a (j£ F q . 

We first show that for every node labeled (p,F p ,x p ), there is an a-labeled arc emanating 
from the node iff a G Act —F p . One direction follows immediately from the construction of the 
tree. For the other direction, let a G Act—F p , then by definition of the valid triples and the 
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closure properties ofVJ-fin, it is straightforward to show that (p; a, 0) G P-^fin- Let x a be the 
(unique) maximum event of p; a; it is then easy to see that there must be an a-labeled arc from 
the (p,F p ,x p ) -labeled node to a (p; a, F',x a ) -labeled node for some F' . 

We now show that for every (p,D p ) G Wr^-, there is some node in the tree with label 
(p,D p ,x p ), and for every {p,F) G VJ-fin, there is some node in the tree with label (p,F p ,x p ) 
for some F p D F. We prove the lemma by induction on the size of p. The base case of 
p = follows easily from the closure properties of VJ-fin. For one case of the induction step, 
let {p,F) G VT^, let x p G max(p), let a be the label of x p , and choose some F p D F with 
(p, F p ) G VT^ such that (p, F p U {c}) G - VT^ f° r all c G Act —F p . Since VJ-fin is prefix-closed, 
there is by induction some node v in the tree with label (r,F r ,x p ), where r = p — x p . From 
the construction of the tree, we can assume without loss of generality that a G - F r . If some 
(qi,F qt , x qt )-labeled node is an ancestor of v with a G F qi and down p (x p ) C q { , let it be the 
least such ancestor. Let q\ be p restricted to q, U {x p }; clearly, q\ is a prefix of p, and hence 
(%',0) G VT^. Thus, there is a {qi,F qi — {a}, ay)-labeled node reachable by the same path 
as the (qi,F qt , x qt )-labeled node, and there is a path from this {qi,F qi — {a}, ay)-labeled node 
to some (r,F r ,x r ) -labeled node. By repeating this argument down the path to (r,F r ,x r ), it is 
easy to prove that there is a-labeled arc from the (r, F r , ai r )-labered node to a (p, F p , ai p )-labered 
node. The induction step for (p,D p ,x p ) -labeled nodes is similar and is omitted. 

Furthermore, it is easy to see that the tree is finitely branching. Since every pomset implic- 
itly represents its isomorphism class, we assume without loss of generality that any two children 
of any given node of the tree will have distinct third components in their labels, i.e., if the labels 
of the children are respectively (*,*,ai) and (*,*,y), then x and y are distinct symbols. 

From this tree, we will recursively construct a loop-free net N in which every place has in- 
degree of at most one. This net preserves concurrency within any branch of the tree; however, 
transitions arising from different branches on the tree will always be conflicting. 

We now recursively construct the following net from the tree, level by level; the procedure 
is analogous to that in the proof of Theorem 4.2.14. For the first level, we begin with a net 
with one place, which is initially marked. For every child s of the root, we add to the net a new 
/ p (ai)-labered transition, named s, where the label of node s in the tree is (p, *,x). The single 
initially marked place is attached as the pre-set of each transition s. All of these transitions 
have empty post-sets. 

For the induction step, we show how to define the (k + l)-level of the tree from the &-level 
segment of the tree. For every node s in the k th level of the tree and each child s' of node s, 
we construct a new / p <(V)-labeled transition, named s' , where the label of node s' in the tree 
is (p', *, x'). It is easy to see that for every maximal cause x G Events^/ of x' , there is a unique 
(*, *, s)-labeled node s" along the path from the root to s' . We then hook up transition s' to the 
(already existing) transition s". This is accomplished by creating a new, unmarked place for 
transition s" and adding it both to the post-set of transition s" and to the pre-set of transition 
s' . If x' G min(p'), then a new initially marked place is added to the net and is attached as the 
preset of transition s' . Finally, transition s' is placed in conflict with every transition v in the 
net such that node v is not a predecessor of s' in the tree. This is accomplished by creating 
a new, initially marked place for every such transition v, and putting this new place in the 
pre-sets of both transition s' and v. 

The procedure is analogous for every node s' labeled with some (p', D p i, ay), except that in 
addition, a new divergence (i.e., a r-transition in a self- loop) corresponding to each d G D p i is 
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hooked up in the obvious analogous manner. 

It is then straightforward to show inductively that for any (p,F p ,x p ) -labeled node in the 
tree, there is a pomset-trace corresponding to p after which exactly the actions in Act —F p are 
enabled. Thus, all pomset-failures in VJ-fin are actual pomset-failures of the net. Furthermore, 
PPfin is exactly the set of pomset-divergences of the net. 

However, for some (p,F p ,x p ) -labeled nodes or some (p,D p ,x p ) -labeled nodes, the marking 
of the net reached after firing some proper prefix of p may generate a failure set that is "too 
big." We thus patch up the net by iterating the following procedure: pick some (p,F p ,x p )- 
labeled node or some (p,D p ,x p ) -labeled node, some proper prefix q of p, and some branch of 
the tree starting at some (q,F q ,x q ) -labeled node, and prune this branch so that each of its 
nodes are labeled with (r,F r ,x r ) for some r such that down r (x) D q for all x G r — q. It is 
straightforward to show that there exists some such pruned branch whose leaves are leaves of 
the original tree. Now, for every occurrence of q in the net that has an incorrect failure set, 
add transitions following q so that it emulates the pruned branch. It is straightforward to show 
firing q in the resulting net always leads to a correct failure set and that the failure sets of 
the markings corresponding to the nodes of the tree are unaffected. Each iteration reduces 
the number of distinct pomsets q with incorrect failure sets, and hence VJ-fin and W^ are 
respectively exactly the pomset-failures and pomset-divergences generated by this net. 

An inductive argument then shows that the net is 1-safe, has a finite number of initially 
marked places, and that all places and transitions have finite in-degree and out-degree. Thus, 
the labeled transition system of the net is finitely branching. However, one complication is that 
the ^/-labeled transitions of N may not clean out all the tokens in the net; this difficulty is 
resolved exactly as in the proof of Theorem 4.2.14. It is then easy to show that the resulting 
net is a WT Net (N, Act) such that {(N, Act)] MVST = (PF, PD, Act). m 

We now show that all compact elements are definable as the [•] TEST meanings of WT Nets: 

Theorem 4.2.16 Let Act be a finite set of labels containing the distinguished symbol y/. For 
every compact element ((PT, Act),(PF,PD, Act)) G £>™ t ST , there is some WT Net {N,Act) 
with l(N,Act)j TEST = ((PT,Act),(PF,PD,Act)). 

Proof. Let ((PT, Act), {PF, PD, Act)) be a compact element of X>™ t ST . As a simple conse- 
quence of Lemma 4.2.12 and the definition of compactness (c/. [18]), ((PT,Act),(PF,PD,Act)) 
is a finite candidate of £>™ ST . Thus, (PT,Act) is a finite candidate of V™% and (PF,PD,Act) 
is a finite candidate of T>^ t ST . Let VJ-fin, W^ be the finite generating sets of PF, PD as given 
by Definition 4.2.10. 

Using the same technique as in the proof of Theorem 4.2.15, we first build a tree whose 
nodes are labeled with valid triples over VJ-fin and augment (Wf^), rather than W^. In 
addition, nodes can also be labeled with valid pairs (p,x p ), where p G PT, (p, 0) G - VJ-fin, 
and x p G max(p). The nodes labeled with valid pairs are connected up as follows. A node 
labeled (p,D p ,x p ) has an a-labeled arc to a node labeled with some valid pair (p',ay) iff 
(p,D p ) C {p',{p'}), p' — x p i = p, and / p /(ay) = a. Finally, a node labeled {p,x p ) has an 
a-labeled arc to a node labeled with some valid pair (p' , ay) iff p' — ay = p and / p <(ay ) = a. 

By the closure conditions of Definition 4.2.7, (p, 0) G PF for every p G PT. Hence, (p, 0) G - 
VTftn for some p G PT, then there must be some (r,D r ) G VD^ such that (p, {Events^}) G 
augment( extend Act{{r,D r ))). Thus, {p,F) G PF for every F C Act. By Proposition 3.2.15 and 
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the prefix- closure of T'Pfin, there must be some (r',D r >) £ augment (W^) with (r',D r >) C 
(p, {EventSp}). It is then easy to show inductively that for every p £ PT, the tree contains 
some node labeled with either (p, *, *) or (*,*), where * is the wildcard symbol. 

The construction of the net is then the obvious straightforward combination of the construc- 
tions in the proofs of Theorem 4.2.14 and Theorem 4.2.15, as is the remainder of the proof. ■ 

The operations on V™^ an( i ^^t T are given in Definition 3.2.28 and Definition 3.2.29, 
respectively. We do not restate the definitions here. Let the operations on V™f T be the 
natural pairwise combination of the operations on V™^ an( i ^^t T - Then: 

Theorem 4.2.17 Let Act be a finite set of labels containing the distinguished symbol y/. Then 
V^^ , V^ t ST , and £>™ t ST are closed under prefixing, restriction, renaming, hiding, sequencing, 
internal choice, CCS choice, non- communicating parallel composition, CSP-style parallel com- 
position, CCS-style parallel composition, split refinements, and choice refinements. Further- 
more, all of these operations are continuous functions on the respective domains. 

Let Act' be a finite set of labels containing y/. Then grow Act' and shrink Act' are con- 
tinuous functions from (V"£,Q™%), (nT^AcH, ^ <2^f, E^f) to (V"$,Q™%), 
(VVr, EZ' T >, ^d (V™?, C™ S , T ), respectively. 

The proof for T>^^ is completely routine but tedious and is left to the reader. 

It is routine but tedious to verify that V^ t ST is closed under all of the operations except 
alphabet expansion and shrinking, grow Act' and shrink Act' are continuous functions from 
(^Act ST , EZ ST > to (£Tt' T , EZ' T >, a11 of the operations are monotone, and that all the opera- 
tions except hiding and CCS-style parallel composition are continuous. The details are left to 
the reader. The proof for V™f T is a simple consequence of Definition 4.2.7 and the continuity 
of the operations on 2>^ Y and V^ t ST . 

We prove the case for hiding on V^ t ST , from which the proof for CCS-style parallel compo- 
sition follows easily. The proof for hiding is a generalization of that in [8] for failures semantics, 
and uses the following lemma: 

Lemma 4.2.18 Let (q,D q ) be a pomset-divergence over a finite alphabet Act, let a £ Act, 
and let PDS = {(p n ,D n ) : n > 0} be an infinite set of pomset-divergences such that (p n ,D n ) — 
a = (q,D q ) for all (p n ,D n ) £ PDS. Then there is some pomset-divergence {r ,D U R) with 
(r , D U R)— a HI (q, D q ) and some infinite sequence r\, r 2 ■ ■ ■ of pomsets such that for i > 0: 

• Ti is a prefix of r J+1 . 

• All events in r, — r are a-labeled. 

• For every d £ R, r\ contains an i-length chain of a-labeled events whose downward- closure 
restricted to r is a subset of d. 

• (ri,D) is a prefix of some (p nt ,D nt ) £ PDS. 

Proof. Let (r ,D) be a pair consisting of a pomset, r , together with a possibly empty 
set, D, of its prefixes such that 

• (r ,D) is a prefix of an infinite number of pomset-divergences (p nt ,D nt ) £ PDS. 
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• For every pair (r' , D 1 ) that is a prefix of an infinite number of pomset-divergences in PDS, 
if (r , D) — a is a prefix of (r' , D 1 ) — a, then (r , D)— a and (r' , D 1 ) — a are isomorphic. 

Clearly, (0,0) is a prefix of every pomset-divergence. Since the size of all such (p' ,D') — a 
is bounded by (q,D q ) it is easy to see that a pomset-divergence (p ,D) exists that satisfies the 
above conditions; however, it is not necessarily unique. 

Let (q',D q >) = (r ,D) — a for some such pair (r ,D); clearly, (q',D q >) is a prefix of (q,D q ). 
Let R be the following set of downward- closed subsets of r : 

R 1 = {down ro (d) : d G D q , down ro (d) G - D, and d C q'} 
R 2 = {down ro (down q (x) P\ q') : x £ q — q'} 
R = i?i U i?2 

It is straightforward to show that the maximality conditions of (r , D) imply that (r , D) is 
extended in PDS by concurrent chains of a-labeled events of unbounded length in PDS , and 
whose set of downward- closures is exactly R. It is also easy to see that (r , D U R)— a C (g, D q ), 
proving the lemma. ■ 

We now prove the continuity of the hiding operation on V^ t ST : 

Lemma 4.2.19 Let Act be a finite set of labels containing the distinguished symbol y/. Then 
the hiding operation on T>^ t ST is continuous. 

Proof. One direction follows immediately from the easy observation that hiding is a mono- 
tone function. For the other direction, let A be an infinite chain in T>^ t ST , let {(PF k , PD k , Act) : 

k G I A } = A for some index set I A , and let (PF A ,PD A ,Act) = \_\A. For one case, let 
(q,D q ) G f]{PD k — a: k G I A }. Lemma 3.2.15 and the closure properties of the PD k imply 
that for every PD k with k G I A , there is some (p k , D k ) G PD k U PF k and some possibly empty 
set R k of downward- closed subsets of Events^ such that (p k , D k U R k ) is a pomset-divergence, 
(p k ,D k I) R k }- a Q (q, D q ), and for all ra > 0, there is some p k n with {p^,D} G P-D& U PFfc such 
that: 

• (/,P & )E(^,{Events P iJ). 

• All events in p k n — p k are a-labeled. 

• For every d G R k , there is some ra-length chain of a-labeled events in p k n — p k whose 
downward closure restricted to p k is d. 

Furthermore, we can clearly assume without loss of generality that every p k n has size bounded 
by \p k \ + \R k \ X n. 

Let PDS be the set {{p k ,D k U R k ) : k G I A }. If PDS is finite, then it is easy to see 
that an infinite number of (PT k ,PF k ,PD k ,Act) G A have the same (p k , D k , R k ) and the same 
sequence p k ,p k ,.... Since A is a chain, this (p k ,D k ,R k ) and this sequence p^p*?--- must 
occur in every element of A, from which it follows easily that (q,D q ) G PD A . If PDS is 
infinite, then clearly there must be some infinite subset PDS' of PDS such that for all (p 8 , D l U 
P 8 '), (p 7 ',^' U R j ) G PDS, (p%P 8 ' U P 8 ')- a = (p 7 ',^^ U R j )-a. Thus, Lemma 4.2.18 gives the 



96 CHAPTER 4. THE SEMANTIC DOMAINS 

existence of a prefix (r ,D) of some (p k ,D k U R k ) G PDS, some set R of prefixes of r with 
{r ,D UiJ)-aC (q,D q ), and some appropriate sequence 77, r 2 ■ ■ ■ such that every (ri,D) is a 
prefix of some (p\ D 8 UP 8 ) G PDS . Thus it follows by closure properties of the (Pp, PDi, Act) 
that (ri,D) G PP 8 - U Pp. The definition of PDS and the chain condition then immediately 
implies that (r , -D) and all of the (r,, D) are in PP m U PF m for every (PF m , PD m , Act), from 
which it follows easily that (q,D q ) G PD A . 

The proof that p|{Pp% — a : k G Pi} C PP^ is very similar and is left to the reader. ■ 



4.3 The Split Semantics 

This section gives abstract characterizations of the [-]^ t s I and l/]™^ semantics on WT Nets, 
shows that they form algebraic cpo's, and proves that all the corresponding process operations 
from Chapter 3 are continuous functions on these cpo's. 

We define (P^ T - split " 7 , E^ T - split " 7 ) as a sub-partial-order of (V^ t ST , C^ c u t ST ) corresponding 
to J.] MUST meanings of 7 -\- M dupl- split nets. In order to ensure that every compact element of 
X'^ [ ^ T " Bpllt " 7 is definable as the [-]^ t s I meaning of some WT Net, we require that p™f-' pl "-' y 
satisfy some additional closure conditions. 

First, we must ensure that Act is a "dupl-split alphabet," and that PF and PD are closed 
under "O-splitting" any a -labeled events. Dually, any minimal pomset-failure or pomset- 
divergence must be the result of "O-splitting" some 1-2-respect'mg pomset. We note that the 
definition of 1-2-respect'mg ensures that no c^-labeled event must be a maximal cause of any 
divergence. Furthermore, any maximal c^-labeled events corresponds to "half-fired" a -events 
and hence can be relabeled with a . Also, firing any c^-labeled event additionally enables only 
a a 2 -labeled event. The special role of y/ and 7 is also reflected in the closure conditions. In 
particular, (le) reflects the presence of initial r-moves. 

Definition 4.3.1 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a G 
Act -{7, a/}} U {a/, 7}. A triple (PF,PD,Act'} is said to be MUST-split-respecting iff it is a 
MUST-respecting triple and satisfies the following properties: 

1. Additional closure properties of PF: 

(a) O-split(PF) C PF. 

(b) {p,F) G l-2-respect(PF) and p' G cr(p) implies that (p',0) G PF, where a is the 
sequence of choice refinements (choice^ aiaiao ^ : a G Act — {7, a/}). 

(c) {p,F) G PF, c G Act— {7, a/} 5 an( i {Vi P U { c i}) ^ P^ implies that there is some 
p' G p with C\ such that (p 1 , F — {c 2 }) G PF. 

(d) (-y,Act) ePF. 

(e) (0,PU{a})GPP and (a, 0) G PF implies that (0, P U {a, 7}) G PF. 

2. Additional closure properties of PD: 

(a) {p,D) G min\z{PD) implies that (p,D) G augment(0-split(l-2-respect(PD))). 

(b) O-split(PD) C PD. 
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(c) {p,D) G l-2-respect(PD) and p' G <?(p) implies that {p',D) G PD, where a is the 
sequence of choice refinements {choice( aiaiao - } : a G Act — {7, V/)- 

(d) {p,D) G min\z(PD) implies that p contains no 7-labeled events. 
3. Additional mixed properties: 

(a) (p, F) G PF and (p, {Events^}) G - PD implies that 
{p,F) G augment(0-split(l-2-respect(PF))) 

(b) (p, P) G P-F and (p, {Events^}) G - PD and p contains a ^/-labeled event implies that 
this is the sole event in p. 

(c) {p,F) G PF, (p, {EventSp}) G - PD, and Ffl {a ,«i} 7^ for some a G Act-{~f,y/} 
implies that F D {a ,cii}. 

(d) {p,F) G l-2-respect(PF), (p, {Events^}) G - PP, and a 2 G F for some a G Act-{~f,y/} 
implies that no event in p is c^-labeled. 

Definition 4.3.2 Let Act be a finite alphabet containing y/ and let Act' = {a ,cii,a 2 : a G 
Act -{7, y/}}U {y/,"f}. A pair {{PT, Act) , {PF, PD, Act')) said to be TEST-split-respecting iff 
(PT,Act) is MAY-respecting , (PF,PD,Act') is MUST-split-respecting , and 

f. p G PT and p' G cr(8(p)) implies that (p',0) G PF, where 8 is the sequence of choice 
refinements {choice( aaoa r- } : a G ^4c£ — {7, y/}), o is the sequence of split refinements 
{split a , ai a ^ : a G ^4c£ —{7, \/}), and all the a' are distinct symbols not in Act U ^4c£'. 

2. {p,F) G PP and (p, {Events^}) G - PD implies that there is some p' G PT such that 
p G augment(a(8(p'))) , where a and <*) are as above. 

3. (p,D) G min\z{PD) implies that there is some p' G PT such that p G augment(a(8(p'))), 
where a and <*) are as above. 

Definition 4.3.3 Let Act be a finite alphabet containing y/ and let ^4c£' = {a ,cii,a 2 : a G 
^-{7,^}} U {y/,"/}. Tne n P^ T - split " 7 is the restriction of V^J T to MUST-split-respecting 
triples and c^ T - split " 7 is the restriction of C^ u t ? T to z>MusT-,pii.- 7 X z>MusT-, P ii.- 7> 

Definition 4.3.4 Let Act be a finite alphabet containing y/ and let Act' = {a ,cii,a 2 : a G 
Act— {7,-\/}} U {-y/, 7}. Then P^c^ct' 1 ' 7 is defined to be the set of all TEST-split-respecting 
pairs {{PT, Act), {PF, PD, Act')). Furthermore, C™^"^) 1 '" 7 is the binary relation on P™^"^*' 11 '" 7 
such that for every («i,/3i) and {a 2 ,(l 2 ) in P™^?'" 7 ; («i, ^i)^™^"^! 1 '" 7 '(a 2 , /3 2 ) iff aiE^ Y a 2 
and/^C^™- 7 /^. 

We first show that [-]^ t s I and l/]™^ map WT Nets to elements of these domains: 



Theorem 4.3.5 Let {N , Act) be a WT Net, and let Act' = {a ,a 1 ,a 2 : a G Act-{j,y/}} U 

K e re'™" 7 and [(N,Act)]™£ G 2>™f 



{7, V}- Then [(iV,^)]^ G V™J?^ and [<JV, ^c*)]™* G Pj— 1 "- 7 
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Proof. We first prove the case for [-]^ t s I. Since WT Nets are ciosed under -\- M and 
dupl-split, the definition of {-jf^ and Theorem 4.2.8 together imply that [(JV, Act)}™™? e 
'D^Act 1 ' 1 '• The additional closure conditions of Definition 4.3.3 follow directly from the properties 
°f 7+m an d dupl-split nets, and are easy to verify. The details are left to the reader. 

F° r ["]™it-7? it 1S straightforward to see from the definitions of pomset-traces, pomset-failures, 



and pomset-divergences of WT Nets, the definition of l/]™;^, the definition of dupl-split and 
7+ M , and Proposition 3.2.15 that the additional closure conditions hold. The theorem then 
follows easily from Theorem 4.2.8 and the above case. ■ 



Theorem 4.3.6 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a £ 
Act -{ 7 , V}} U W, 7}- Then (T%™-^ , c^™" 7 ) and (D™-, E^f^) are com- 
plete partial orders. 

The proof of the theorem is an easy combination and adaptation of the proof of Theo- 
rem 4.2.9. The details are left to the reader. 

We now give a finite characterization of the compact elements of X>^ [ ( ^ T " spllt " 7 and ^A^tA^ct^' 1 ■ 

Definition 4.3.7 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a £ 
Act -{7, y/)}U{y/, 7}. A triple (PF, PD, Act') is a finite candidate of pMusT-s P ii.- 7 iff ^ p ^ pD ^ Acf ^ 
£ p™f"' pl "" T anc [ (PF, PD, Act'} is a finite candidate of V\ U ^ T . A tuple (a, (3) is a finite can- 
didate of ^ , ™ t b ^"ct' 11 '" 7 iff { a -,P) £ ^ActA^ct^' 1 ' 1 a 1S a finite candidate of V™^ , and (3 is a finite 
candidate of X'^ [ ^ T " Bpllt " 7 . 

As an immediate consequence of Definitions 4.3.3 and 4.3.4 and Lemma 4.2.11, we have: 

Lemma 4.3.8 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a £ 
Act— {j,y/}} U {-y/, 7}. Then all finite candidates of pMUbT-spht-7 an( ^ pTEbT-spht-7 arg com p ac ^ 

1 a -f -T-lMUST-split-7 j ^-.TEST-split-7 , • i 

elements of V Act , and V Act Art , , respectively. 

We now show: 



Lemma 4.3.9 Let Act be a finite alphabet containing yj and let Act' = {a ,ai,a 2 : a £ 
Act-{j,y/}} U {V,7}- For every (PF,PD,Act') £ x>^ T " 8pUt " 7 , there is a directed set A 1 C 
p MusT-spii.-7 of finite candidates with LJAi = (PF,PD,Act'). For every (a,/3) £ Vf^f 1 ' 1 , 
there is a directed set A 2 C ^™t Act' 1 '" 7 °f finite candidates with \_\A 2 = (a, (3). 



Proof. The proof for V Act , " Bpi " 7 is a minor modification of that of Theorem 4.2.12, needed 
in order to ensure that closure condition (2a) of Definition 4.3.3 holds for every approximation. 
For every n > 0, we define n th approximation, (PF n ,PD n ,Act') to (PF,PD,Act') as follows: 



PP' = {(p, P) £ PP : p is a prefix of some q such that (g, 0) £ PF, 

and either (q, {Events^}) £" PP or (q,D) £ min\z(PD) for some P} 

PP"g n _ n = {^ 5 ^) G p_p' : depth(p) <n}U {(p, F) : (p, 0) £ PF' , depth(p) = n, and F C ^c^'} 
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VV^-n = {(p, DUD'}: (p, 0) G VT'^_ n , D U D' ^ 0, either (p, D) e PD or D = 0, 

and for all d G -D', either d = down p (x) U {x} for some a; such that 

depth (x) = n, and l p (x) ^ cii for any a G ^4c£ — {j,y/}, 

or d = down p (y) U {y} for some y such that 

y is a maximal cause of some x with depth (x) = n, 

and / p (a;) = b\ for some 6 G Act — {7, yO'} 

P_D n = augment(extend Act t(W^ n _ n )) 
VTfin-n = augment (V '.^-J 

P_F n = P^fm-n U implied- f allures Act t(PD n ) 

The proof of this case is then a straightforward adaptation of that of Theorem 4.2.12; the 
details are left to the reader. 

The proof of P >T J ^ T A s r v ^ t ' 1 ls a straightforward adaptation of the proof of Theorems 4.2.12 
and the above case; the details are left to the reader. ■ 

We now have: 

Theorem 4.3.10 Let Act be a finite alphabet containing \J and let Act' = {a ,ai,a 2 : a G 
Act— {j,\/}} U {-y/, 7}. Then pMUbT-s P iit- 7 an( ^ pTEbT-s P iit- 7 arg a ig e b ra j c C p 's. 

The theorem is a simple consequence of Lemma 4.3.8 and Lemma 4.3.9 (c/. [18]). 
We now show that all compact elements are definable as the meanings of WT Nets: 

Theorem 4.3.11 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a G 
Act— {~/,\/}} U {-y/, 7}. For every compact element (PF, PD, Act') G p^ubT-bpht^ there is 
some WT Net (N l ,Act) with {(N^Act)}™^ = {PF,PD,Act'). For every compact element 

((PT, Act), (PF, PD, Act')) G Vf^f '"^there is some WT Net (N 2 , Act) with {(N 2 , 4c*)]™* 
= ((PT, Act), (PF, PD, Act')). 

Proof. For the first case, let (PF, PD, Act') be a compact element of V A i ^ t ST . As a simple 
consequence of Lemma 4.3.9 and the definition of compactness (c/. [18]), (PF,PD,Act') is a 
finite candidate of X'^ [ ^ T " spllt " 7 . 

The construction of the tree is analogous to the proof of the proof of Theorem 4.2.15, except 
that nodes are labeled with pomset-failures only from 0-split( l-2-respect(V T^)) (rather than 
VTftn) and with pomset-divergences only from 0-split(l-2-respect(Wfc a )) (rather than W^). 
Furthermore, the root has r-labeled arcs to nodes labeled with valid triples of the form (0, {0}, •) 
or (0, F U {7}, •). Finally, an additional restriction is that a node labeled (p, F p , x p ) has an a^- 
labeled arc to a node labeled with (p 1 ' ,F p i,x p i), then F p — {a 2 } C F p i. The remainder of the 
proof is a straightforward modification of the proof of Theorem 4.2.15; the details are left to 
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the reader. In particular, using closure condition (3a), it is easy to rewire the net to simulate 
duplicate-splitting. 

We remark that the "patching-up" process is done first on prefixes whose maximal nodes 
are all a -labeled or a 2 -labeled. The failure sets for the remaining prefixes are then chosen 
appropriately. 

The resulting net is then isomorphic to 7 -\- M ( dupl- split '((iVi, Act)) grow {7}) for some WT 
Net (N 2 ,Act), proving this case. 

The proof for T^A^tA^ct^' 1 ls then a straightforward combination of the proofs of Theo- 
rems 4.2.16 and the previous case; the details are left to the reader. ■ 

The operations on pMUbT-spht-7 arg gj ven j n Definition 3.2.45. We do not restate the def- 
initions here. Let the operations on ^ActA^ct^' 1 be the natural pairwise combination of the 
operations on V 1 ^^ and pMUbT-spht-7^ r pj ien: 

Theorem 4.3.12 Let Act be a finite alphabet containing y/ and let Act' = {a ,cii,a 2 : a £ 
Act— {7,-^/}} U {y/, 7}. Then pMUbT-spht-7 an( ^ pTEbT-spht-7 arg c i osec [ unc [ er prefixing, restric- 
tion, renaming, hiding, sequencing, internal choice, CCS choice, non- communicating parallel 
composition, CSP-style parallel composition, CCS-style parallel composition, split refinements, 
and choice refinements. Furthermore, all of these operations are continuous functions on the 
respective domains. 

Let Acti be a finite alphabet containing y/ and let Act\ = {a , ai, a 2 : a £ Act\ —{7, y/}} U 
{\A t}- Then grow Act x and shrink Act x are continuous functions from (V A 1 ^ T ~* pht ~~ t , QMUbT- B pht-7\ 

aT1 J /^TEST-split-7 r TEST-split- 7 \ , /T) MUST-split-7 ,-MUST-split-7 \ i /T) TEST-split-7 ,-TEST-split-7 \ 

ana \U ActtAct , 1^= Act, Act' I l ° \ U Act x ' i^Actr' I anC1 \ U Act X) Act x ' > != Act X) Act x ' 1 1 re ~ 

spectively. 

Proof. It is straightforward but tedious to show that pMUbT-spht-7 ^ g c ^ osec [ unc [ er a \\ 
of the operations except alphabet growing and shrinking, and that the domain and range of 
grow Act 1 and shrink Act\ are as specified. It is easy to show that + M , augment, extend 
1-2-respect, 0- split, 0-1-choice, and 0-1- split are continuous functions. The theorem then fol- 
lows easily from Theorem 4.2.17. ■ 



4.4 The Interval Semantics 

This section gives abstract characterizations of the [-]^7, ['E^I, and l/]™^ semantics on 
WT Nets, shows that they form algebraic cpo's, and proves that all the corresponding process 
operations from Chapter 3 are continuous functions on these cpo's. 

Definition 4.4.1 Let Act be a finite alphabet containing y/ and let Act' = {a ,cii,a 2 : a £ 
Act-{~f,y/}} U {y/, 7}. Then 2>^ Y - intvl is defined to be the set intervals{V^ ) . Furthermore, 
E^t Y " in ' vl is the binary relation on D^ Y - intvl such that for every (PT u Act) and (PT 2 , Act) in 

pMAY-in.vl^ (pr i7J 4 C ^)E^ c A t Y - intvl (Pr 2 ,^rf 2 ) iff PTi C PT 2 . 

-7->MUST-intvl-7 • J n J j- "U j-"U j-'-t 1 /TiMUST-split-7 \ j-\ ,1 r— MUST-intvl-7 • ,1 

D Act , ' is denned to be the set intervals^ D Act , '). iurthermore, ± Act > is the 

binary relation on V Ac £ " mtv " 7 such that for every (PFi, PDi, Act') and (PF 2 ,PD 2 ,Act') in 
X>^ T - intvl -T, (PF 1 ,PD 1 ,Act')Q A 1 l s , T - intvl -~<(PF 2 ,PD 2 ,Act') iff PF 1 D PF 2 and PD 1 D PD 2 . 
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1 TEST-intvl-7 •jnijiji i ■ , ; /-i-,TEST-split-7 \ t-i ,1 ,— TEST-intvl-7 



^ Act Act 1 ''' 1 i s defined to be the set intervals(V Act A ^ '' r ) . Furthermore, QActAct*' 1 is 
he binary relation on T^ Ac ^ A ^, v '' y sucn that for every (ai,/?i) and {a 2 ,(3 2 ) i n ^Act Act' V ~ 7 ' 

/O \ 1 — TEST-intvl-7 / /O \ -rr i — MAY-intvl J a I — MUST-intvl-7 /O 

aiJh)Q Act A Ct > J {a 2 ,f3 2 ) iffaiE^ct "2 and ftC^ t , 7 /3 2 . 



We hrst show that the interval semantics of Chapter 3 map WT Nets to elements of the 
above partial orders: 

Theorem 4.4.2 Let (N,Act) be a WT Net. Then l(N,Act}]%™ G X>^ Y - intvl , l(N,Act}]%™* G 
pMusT-intvi-^ and l( N ,Act)}™™ G x» TEST - intv1 " 7 



7 
1-7 

vl-7 c u Act, Act' 



The theorem is a simple consequence of the definitions of [•] 1 ^ Y , ['E^I, ["Kfvi^p Theo- 
rem 4.2.8 and Theorem 4.3.5. 

The following propositions will be useful in the technical development in this section: 

Proposition 4.4.3 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 '■ a G 
Act— {~f,y/}} U {y/, 7}. The intervals and augment functions on 2>^ Y " intvl are con tinuous and 
the intervals, augment, extend, and 0- split functions on V Ac £ " mtv " 7 are continuous. 

Proposition AAA Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a G 
Act-{>y, y/}} U {V,7}- Let (PT,Act) G V^ and let (PF,PD,Act') G z>MusT-,piit- 7> Then 



• augment(intervals((PT,Act))) G T> 



MAY 
Act 



• 



• 



intervals(augment(intervals((PT, Act)))) = intervals((PT, Act)) 



augment(extend Act i(0-split(intervals((PF,PD,Act'))))) G V 



MUST-split-7 
Act' 



• intervals(augment(extend Act i(0-split(intervals([PF, PD, Act')))))) = 
intervals((PF, PD, Act')) 

• {PF, PD, Act')Q A 1 ^ T ~ spht ~~ t augment(extend Act i(0-split(intervals((PF, PD, Act'))))) 

The proof of Proposition 4.4.3 is routine. The hrst two items of Proposition 4.4.4 follows 
easily from Proposition 4.2.1 and Definition 4.2.5. The remaining items of Proposition 4.4.4 
follows easily from Proposition 3.2.15, Proposition 3.3.9, Proposition 4.2.1, and Definition 4.3.3. 
The details are left to the reader. 

Theorem 4.4.5 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a G 
Act -{ 7 , y/}} U W, 7}- Then (P^™, EZ™), (D^™" 7 , C^™" 7 ), and 

/T-lTEST-intvl-7 ,— TEST-intvl-7 \ 1 i- +• 1 J 

\ V Act,Act' \^Act,Act- I, are complete partial orders. 

■jMAY-intvl 1— MAY-intvl \ /^-.MUST-intvl-7 |— MUST-intvl-7 \ 



Proof. It is easy to see that (Dl A ™ , Elf" 11 '" > , (KcJ , Elt' ) > and 

/T-lTEST-intvl-7 ,— TEST-intvl-7 \ + • 1 J 

\ V Act,Act' \^Act,Act' I are partial orders. 

We give the proof of completeness for 2>^ Y " intvl . It is easy to see that (0, Act) is the least 
element of D^ t Y - intvl . Let A be a directed set in 2>^ t Y - intvl ; then by definition of 2>^ t Y - intvl , 
A = intervals(B) for some set B C V^^ . Proposition 4.4.3 and Proposition 4.4.4 im- 
ply that augment(intervals(B)) is a directed set in V™^ , and Theorem 4.2.9 implies that 
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(J augment (intervals(B)) £ T>^t • By definition, intervals(\\augment(intervals(B))) £ 2>^ Y " intvl 
and by Proposition 4.4.3 and Proposition AAA, 

intervals(\\augment(intervals(B))) = \\intervals(augment(intervals(B))) = \\(intervals(Bj), 

proving this case. 

The proofs for V Ac f, " mtv " 7 and ^ Act Act'"' 7 are completely analogous, except that they use 
Theorem 4.3.6. The details are simple and are left to the reader. ■ 

We now give a finite characterization of the compact elements of these domains. 

Definition 4.4.6 Let Act be a finite alphabet containing y/ and let Act' = {a ,ai,a 2 : a £ 
Act-{i,y/}} U W,~f}. A pair (PT,Act) is a finite candidate of X>^ Y - intvl iff (PT,Act) = 
intervals((PT , Act)) for some finite candidate (PT',Act) of P^ C AY . A triple (PF,PD,Act') is 
a finite candidate of P Act , " mtv " 7 iff (PF,PD,Act') = intervals((PF' , PD' Act')) for some finite 
candidate (PF' , PD', Act') of P^ J t bT " spllt " 7 . A tuple (a,(i) is a finite candidate of X , ™ t b ^"! v1 " 7 iff 
(a, (3) = intervals((a' , fi')) for some finite candidate (a',f3') of P™^"^' 1 '" 7 - 

Lemma 4.4.7 Let Act be a finite alphabet containing -^/ and let Act' = {a ,ai,a 2 : a £ 
Act -{ 7 , ^}} U W, 7}. Then all finite candidates of X»^ Y - intvl , l^usT-intvi^ and D™^™" 7 are 
compact elements of P^ AY " mtvl , V Ac f, " mtv " 7 5 an d P^^c"''" 7 , respectively. 

Proof. The proof for 2>^ t Y - intvl is identical to that for P^ C AY in Theorem 4.2.11. 

Let intervals((PF, PD, Act')) be a finite candidate of T> Act b , " mtv " 7 and let A be a subset of 
T> A 1 ^ t b , T ~ spht ~~ t such that intervals(A) is a directed set in pMUbT-mtvi-7 an( ^ 
mteTOa/s((P J F,P J D,^rf'))C^ T - intvl - 7 |JmteTOa/s(A). By Propositions 4.4.3 and 4.4.4, 



(PF, PD, Act') ^MUbT-bpiit-7 augment(extend Act i(0-split(intervals((PF, PD, Act'))))) 
C^ t bT " spllt " 7 augment(extend Act i(0-split(\\ intervals(A)))) 
EAct' T " BPllt " 7 U augment(extend Act i(0-split(intervals(A)))) 



Since by Theorem 4.3.8, (PF, PD, Act') is a compact element of pMUbT-spht-7^ ^ere is some 

(PF n ,PD n ,Act') £ A with 

(PF, PP, Act')Q A 1 ^i T ~ spht ~~ t augment(extend Act i(0-split(intervals((PF n , PD n , Act'))))). 
Then by Proposition AAA, 

intervals((PF, PD, Act')) E^ T - intv1 " 7 

intervals( augment( extend Act i(0-split(intervals([PF n , PD n , Act')))))) 



which by Proposition 4.4.4 is equal to intervals([P F n , P D n , Act )), proving this case. 

•jTEST-int 
Act, Act 1 



The proof for T> Al ^ A ^, v " 7 is a simple consequence of the previous two cases and is left to 



the reader. 



Lemma 4.4.8 Let Act be a finite alphabet containing \J and let Act' = {a ,ai,a 2 : a £ 

WAY 
Act 



Act-{-y,y/}} U W,~/}. For every (PT,Act) £ P^ AY - intvl , there is a directed set A 1 C pMAY-intvi 
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of finite candidates with |J A x = (PT,Act). For every (PT,Act') £ T> Ac f, " mtv " 7 5 there is a 
directed set A 2 C T> Act 1 " mtv " 7 of finite candidates with \_\A 2 = (PT,Act'). For every (a, (3) £ 
^ActAct''" 7 ' there is a directed set A 3 C T) A ct AcV ^ °f finite candidates with |_|A 3 = (a, (3). 

Proof. We prove the case for 2>^ Y - intvl . By definition, {PT,Act) = intervals({PT' , Act)) 
for some (PT',Act) £ T^^ct • Lemma 4.2.12 gives a directed set B of finite candidates of 
£>^ C AY whose least upper bound in £>^ C AY is (PT',Act). Thus, (PT,Act) = intervals^ B). By 
Proposition 4.4.3 and Definition 4.4.6, intervals(B) is a directed set of finite candidates of 

pMAY-in.vl and 

(PT^Act) = intervals(\ \B) = \intervals(B). 
The proofs of the other cases are analogous and are omitted. ■ 



Theorem 4.4.9 Let Act be a finite alphabet containing y/ and let Act' = {a ,cii,a 2 : a £ 
Act-i^V}} U W,l}- Then 2^™, D^™" 7 , and D™^" 7 are algebraic cpo's. 

The theorem is a simple consequence of the definition of compact elements and Lemma 4.4.7 
and Lemma 4.4.8 (cf. [18]). 

Theorem 4.4.10 Let Act be a finite alphabet containing y/ and let Act' = {a ,cii,a 2 : a £ 
Act-{j,y/}} U W,j}. For every compact element (PT,Act) £ 2>^ Y - intvl , there is some WT 
Net (N u Act) with [(iV l7 4ci)]?££y = (PT,Act). For every compact element (PF,PD,Act') £ 
X>^ T - intvl -T, there is some WT Net (iV 2 , Act) with [(iV 2 , 4ci)]?£™* = (PF, PD, Act'). For every 
compact element (a,/3) £ P™ t s ^ v1 " 7 , there is some WT Net (N 3 ,Act) with l(N 3 ,Act)}™? y = 
(a, 13). 

The theorem is a simple consequence of the definition of [•] 1 ^ Y , ['E^I, ["ISfvi^ Lemma 4.4.8, 
and Theorems 4.2.14 and 4.3.11. 

The operations on 2>^ Y " intvl , V Act b , " mtv " 7 5 an d T^Act Act 1 "' 1 are given i n the proof of Theo- 
rem 3.3.10. We do not restate the definitions here. We have that: 

Theorem 4.4.11 Let Act be a finite alphabet containing y/ and let Act' = {a ,cii,a 2 : a £ 

Act-{j,y/}} U W,j}. Then 2^™, D^ST-intvl^ aQ(i p TEST-intvl- 7 ^ ^^ ^^ prefix _ 

ing, restriction, renaming, hiding, sequencing, internal choice, CCS choice, non- communicating 
parallel composition, CSP-style parallel composition, CCS-style parallel composition, split re- 
finements, and choice refinements. Furthermore, all of these operations are continuous functions 
on the respective domains. 

Let Acti be a finite alphabet containing y/ and let Act\ = {a , cii,a 2 : a £ Act\ — {7, y/}} U 
{\At}- Then grow Act\ and shrink Act\ are continuous functions from (2>^ Y " intvl , E^ t Y " intvl ), 

/^-.MUST-intvl-7 |— MUST-intvl-7 \ 1 /-j-jTEST-intvl-7 |— TEST-intvl-7 \ , /-T-)MAY-intvl |—MAY-intvl\ 

\ u Act' i^=Act' h dllU \ U Act, Act' 1^= Act, Act 1 I l ° \ U Act' i^=Act' h 

/-j-«MUST-intvl-7 |— MUST-intvl-7 \ J /-nTEST-intvl-7 |— TEST-intvl-7 \ -f 1 

\ u AcW i^=Act x < /, ana {L> ActliActl > ,^=Act 1 ,Act 1 ' /, respectively. 

The theorem follows easily from Theorems 4.2.17 and 4.3.12, and Proposition 4.4.3. 
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Chapter 5 

Action Refinement 

5.1 An Action Refinement Operator 

This section presents our action refinement operator on a restricted class of WT Nets. In order 
to preserve the finite marking condition on Well- Terminating Nets, we will define our action 
refinement on a suitably restricted subclass of WT Nets. 

Definition 5.1.1 The class of Refinable Well- Terminating (RWT) Nets consists of WT Nets 
(N, Act) in which every place has only a finite number of transitions with labels from Act —{y/} 
emanating from it, i.e., for all s G S^, the set {t £ post N (s) : /jv(i) G Act — {\/}} is finite. 

It is easy to show that: 

Theorem 5.1.2 The class of RWT Nets is closed under prefixing (a.), restriction (\a), hiding 
( — a), renaming ([/]), CSP-style sequencing (;), non- communicating parallel composition (||), 
CCS-style parallel-composition-with-hiding (|), internal choice (©), start-unwinding, CCS-style 
choice (+m) 5 split, and choice, but not under CSP-style parallel composition (\\a)- 

Proof. CSP-style parallel composition, ||{ a }, applied to two RWT Nets that each contain 
an infinite number of a-labeled transitions will result in a net in which every a-labeled transition 
of one net is allowed to synchronize with every a-labeled transition of the other net. We recall 
that by definition, all transitions in WT Nets have non-empty presets. Thus, it is easy to 
see that some place in this resulting net must have an infinite number of a-labeled transitions 
emanating from it, violating the defining condition on RWT Nets. 

The proof that RWT Nets are closed under ah the other net operators follows easily from 
Theorem 2.2.16 and is omitted. ■ 

Our action refinement operator (N , Act)[a: = (N a , Act)] "replaces" each a-labeled transition 
in the target net (N, Act) by a separate but identical copy of the refinement net {N a , Act); these 
copies are distinguished by "tagging" the names of the places and transitions of N a with the 
name of the corresponding a-labeled transition. We want our action refinement operator to 
satisfy some intuitively simple distributivity properties, and so we need to be careful in how we 
hook up the copies of N a to the places of N. 
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(N,Act) 



{N a ,Act) 




(N,Act)[a:=(N a ,Act)] 



Figure 5-1: An Example of Action Refinement 



In the same spirit as the definition of the -\- M operator, we take cross products of the start 
places of appropriate copies of N a ; in particular, for every place s in N, we take a cross product 
v of the start places of the copies of N a corresponding to the a-labeled transitions emanating 
from s. Furthermore, in the same spirit as the definition of sequencing, we relabel with r 
all of the ^/-labeled transitions of the copies of N a and connect them all up to the post-set 
of the corresponding a-labeled transition. The other transitions of the copies of N a and the 
non-a-labeled transitions of N are then hooked up to all of these places in the expected manner. 

Not surprisingly, we encounter the same difficulties as the -\- M operator when our refinement 
nets have initially marked places that have incoming transitions, and we thus start-unwind the 
refinement net before performing our replacements. 

The action refinement operator is illustrated in Figure 5-1. 

We now define the action refinement operator. For simplicity we assume that the refinement 
net N a is already start-unwound; otherwise, we first start-unwind N a and then carry out this 
construction using the start-unwound version of N a rather than N a itself. 
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Definition 5.1.3 Let (N,Act) and (N a ,Act) be RWT Nets over a common alphabet Act, and 
let a be a label in Act — {y/}- Then (P, Act) = (N, ^4c^)[a: = (iV a , ^4c£)] is defined as: 

5p = {(s,v) | s G Sn and f: T—^Start Na , where T = {t G post N (s) | /jv(i) = a} } 
l+J {(£, s') | i G Tat, /jv(£) = « and s' G 5*^ — Start Na } 

T P = {(t, *) | i G Tat and l N (t) ^ a} l+J {(M') | i G Tjv, /jv(i) = a and i' G TjvJ 

pre P ((t, *)) = {(s, w) G 5 P | s G pre N {t)} 

post P ((t, *)) = {(s, w) G 5p | s G post N {t)} 

l P ((t,*)) = l N (t) 

pre P ((t,t')) = {(s,v) e S P \s e pre N {t) and v{t) G pre Na {t')} 
l±l {(i,s') G SV|s' Gpre^^')} 

1 FXX ' " 1 {(s,w) G S P | s G posf JV (i)} otherwise 

/ P ((M')) = {^ (f) if f-^^ 

I t otherwise 

Startp = {(s, f ) G 5p | s G Start N ~\ 



We refer to the net (N,Act) as the target of action refinement, or the target net, and we 
refer to the net (N a ,Act) as the operator of action refinement, or the refinement net. 

The following facts will be useful in proving that the class of RWT Nets is closed under 
action refinement. 

Definition 5.1.4 Let (JV, Act) and (N', Act) be RWT Nets over a common alphabet Act, let a 
be a label in Act — {y/}, and let r be a run of N of length n. A (JV, r, a, N') -respecting substitution 
is a function a from the set {i : 1 < i < n and /jv (?•[«]) = a} to non-empty runs of N' such that 
for all i G dom(a), if i is a non-maximal event in the pomset-run of r, then some ^/-labeled 
transition of N' occurs in a(i). Let dom(ft) = dom(a), and let each (3(i) = (r[i],ti) . . . (r[i],t k ), 
where a(i) = t x ■ ■ -t k . Then we define ra = r\ . . .r n , where each r, = (i(i) if i G dom(ft), and 
n = (r[i], *) otherwise. 

Lemma 5.1.5 Let (N,Act) and (N a ,Act) be RWT Nets over a common alphabet, Act, such 
that (N a ,Act) is start-unwound, and let a be a label in Act — {y/}. Also, let (P,Act) = 
(N , Act)[a: = (N a , Act)], and let r' be a run of P. Then there is some run r of N and some 
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(N, r, a, iV a )-respecting substitution a such that ra is a run of P whose pomset-run is isomor- 
phic to that of r' . 

Furthermore, let M' be the marking of P reached after firing r' , let M be the marking of N 
reached after firing r, and for all i £ dom(a), let M, be the marking of N a reached after firing 
the run a(i). Then for all places of P of the form (t, s') £ T N X S^ a , 

, , r J if t does not occur in r 

1 Mj(s') if r[i] is the last occurrence of tin r 

For all places of P of the form (s, t> ), 



M'(s,v) 



if for some i £ dom(a) with r[i] £ pre N (s), 

a(i) does not contain a ^/-labeled transition 

1 if there is some i £ dom(a) with r[i] £ post N (s) such that M 8 (f (r[i])) = 1 
Mis) otherwise 



Proof. The proof is by induction on the length of r'. It is easy to see that lemma holds 
for the base case of \r'\ = 0. For the other base case, suppose \r'\ = 1. The proof is obvious 
if r' = (t, *) for some transition t of N that is not a-labeled. Otherwise, r' = (t,f) for some 
a-labeled transition t of N and some transition t' of N a . Let r = t, let dom(a) = {1}, and let 
a(l) = t' . Then it is easy to see that ra = r' and that markings of places of the form T N X S^ a 
satisfy the above equation. The remaining property about markings is easily verified. 

For one induction step, let r' = r".(t, *) for some non-empty run r" and some transition t of 
N that is not a-labeled. By induction, there is some run r of N and some (JV, r, a, iV a )-respecting 
substitution a such that ra is a run of P whose pomset-run is isomorphic to that of r" and the 
properties of the corresponding markings hold. By Proposition 3.2.3, the marking of P reached 
after r" is identical to that reached after ra. Thus, all places (s, v) £ Sp with s £ pre N (t) must 
be marked in P. Suppose for the sake of contradiction that for some place s £ pre N (t) and 
every corresponding v, there is some i £ dom(a) with s £ pre N (r[i]) such that Mi(v(r[i])) = 1. 
Since N is 1-safe, (N a , Act) is start-unwound, and the firing of -^/-labeled transitions cleans out 
N and N a , it would follow from Definition 5.1.3 that there is some unique such i and that a(i) 
is empty, contradicting the definition of a. Thus, it follows from the inductive hypothesis about 
markings that all places s £ pre N (t) are marked in N. It is then easy to see from Definition 5.1.3 
that r.t is a run of N, a is a (N, (r. t), a, N a ) -respecting substitution, and (r.t)a is a run of P 
whose pomset-run is isomorphic to that of r'. Furthermore, since N is 1-safe, it is easy to see 
that the desired property of the markings holds. 

For the other induction step, let r' = r".(t,t') for some non-empty run r", some a-labeled 
transition t of N, and some transition t' of N a . By induction, there is some run r of N and 
some ( JV, r, a, iV a )-respecting substitution a such that ra is a run of P whose pomset-run is 
isomorphic to that of r" and the properties of the corresponding markings hold. For one case, 
suppose that for every occurrence r[i] of t in r, a(i) contains a -^/-labeled transition. Since 
the firing of -^/-labeled transitions cleans out N a , it is easy to see that all such markings M 8 - 
are empty. It then follows easily from the 1-safeness of N that all places s £ pre N (t) must be 
marked in N, and hence that r.t is a run of N. Let a' be the extension of a with a(|r.i|) = t' . 
It is easy to show that a' is a (N, (r. t), a, N a ) -respecting substitution, and that (r.t)a' is a run 
of P whose pomset-run is isomorphic to that of r'. Furthermore, since N is 1-safe, it is easy to 
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see that the desired property of the markings holds. 

For the last case, suppose that for there is some occurrence r[i] of t in r such that a(i) 
does not contain a ^/-labeled event. The 1-safeness of N and Definition 5.1.4 immediately 
imply that i is unique and is the last occurrence of t in r. Thus, it follows from the inductive 
hypothesis about markings that t' is enabled in N a under marking M,. Let a'(k) = a(k).t', let 
dom(a') = dom(a), and let a' agree with a on the rest of dom(a). It is easy to see from the 
above fact about M, that a' is a ( JV, r, a, iV a )-respecting substitution. Furthermore, it follows 
easily from the 1-safeness of N and the inductive hypothesis about markings that rat' is a run 
of P whose pomset-run is isomorphic to that of r'. Finally, since N is 1-safe, it is easy to see 
that the desired property of the markings holds, proving the lemma. ■ 

The following related fact will be useful in proving properties about our semantics: 

Lemma 5.1.6 Let (N,Act) and (N a ,Act) be RWT Nets over a common alphabet, Act, such 
that (N a ,Act) is start-unwound, and let a be a label in Act — {y/}- Also, let r be a run of N 
and let a be a (JV, r, a, iV a )-respecting substitution. Then ra is a run of (JV, Act)[a: = (N a , Act)]. 

Proof. Using Lemma 5.1.5, a straightforward induction on the length of r gives the proof. 
The details are left to the reader. ■ 

We now have: 

Theorem 5.1.7 The class of RWT Nets is closed under action refinement. 

Proof. Let (N,Act),(N a ,Act) be RWT Nets over a common alphabet, Act, let a £ 
Act— {y/}, and let (P,Act) = (N , Act)[a: = (N a , Act)]. For simplicity, we assume that (N a ,Act) 
is itself start-unwound; however, since by Proposition 5.1.2, start-unwind((N a , Act)) is a RWT 
Net, the proof is identical for the general case except that we use start-unwind((N a , Act)) instead 
of (N a , Act). It is easy to see that the initial marking of P is non-empty and that all transitions 
in P have non-empty presets. Definition 2.1.2 and Definition 5.1.1 then imply that only a finite 
number of places of N a are initially marked and that only a finite number of a-labeled transitions 
emanate from any given place in N. Thus, it is easy to see that for every place s G Sn, there are 
only a finite number of functions v. T—^Start Na , where T = {t £ post N (s) | /jv(i) = a}. Using 
the fact that (N,Act) and (N a ,Act) are RWT Nets, it is then easy to show that the initial 
marking of P is finite, the preset and post-set of every transition in P is finite, and that every 
place in P has only a finite number of transitions with labels in Act —{y/} emanating from it. 

Lemma 5.1.5 together with Proposition 3.2.3 and the 1-safeness of N and N a immediately 
implies that P is 1-safe. Similarly, Lemma 5.1.5 together with Proposition 3.2.3 and the fact that 
all places of N and N a are unmarked immediately after the firing of any -^/-labeled transition 
of the respective net immediately implies that the same property about -^/-labeled transitions 
holds for P. Finally, the finite-enabling property for P follows easily from Lemma 5.1.5 together 
with the definition of pomset-runs, Proposition 3.2.3, the fact that (N a ,Act) is start-unwound, 
and the fact that only a finite number of transitions are enabled under any reachable marking 
ofiVoriV„. ■ 
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Our action refinement operator has a rich algebraic theory. For example, the following 
simple identities hold up to l/]™^ equality. We write Succ to denote the WT net which 
must immediately successfully terminate, i.e., exactly one transition is enabled under its initial 
marking and this transition is ^/-labeled. For notational convenience, we simply write a to refer 
to the net a. Succ and write a + .a_ to refer to the net a + .a_.Succ. Furthermore, we write Dead 
to denote the deadlocked process consisting of a single initially marked place and no transitions, 
and a. Dead to refer to the net that does an a and then deadlocks in the sense that no place is 
marked. 

Our action refinement operator satisfies the following simple identities: 



Proposition 5.1.8 Let (N,Act),(Ni,Act),(N 2 ,Act) be RWT Nets over a common alphabet 
Act, and let a,a + ,a_,a L ,a R ,b £ Act— {y/}. Then the following identities hold up to l/]™^ 
equality: 

a[a: = {N;y/,Act)] = {N;^/,Act) 

(N,Act)[a: = (a,Act)] = (JV ', Act) 

(N,Act)[a: = (Dead,Act)] = {N,Act)\a 

(JV, Act)[a: = {r, Act)] = (JV, Act)[a: = {Succ, Act)] = (JV, Act) - a 

spUt( a , a+ , a _)((N,Act)) = (N,Act)[a:=(a + .a_,Act)] 

choice (aaLaR) ((N,Act)) = (JV, Act)[a: = (a L Am a R , Act)] 

Assuming that a and b are "fresh" labels, (i.e., JVi and JV 2 contain no a-labeled or 6-labeled 
transitions), we also have up to l/]™^ equality: 



((a+ M 6)[a: = (iV 1 ;V,^^)])[6 

((a.b)[a:=(Nuy/,Act)])[b 

((a||6)[a: = (JV i;> /,^c<)])[6 



--{N 2 -y/,Act)] = {N 1 ; y /,Act)+ M {N 2 ; y /,Act) 
--{N 2 ;y/,Act)\ = (Nu^Acty^N^^Act) 
--{N 2 ;y/,Act)] = (Nu^AcQWiNti^Act) 



For all refinements p, the following distributivity properties hold up to J-]™;^ equality: 

((N 1 ,Act)+ M (N 2 ,Act))p = (N u Act)p+ M (N 2 ,Act)p 

((N 1 ,Act);(N 2 ,Act))p = (N u Act)p;(N 2 ,Act)p 

((N u Act) 1 1 {N 2 , Act))p = (N u Act)p \\ {N 2 , Act)p 

Proof. We give a sketch of the proofs of these identities. It is easy to see that that 

(N,Act)[a: = (Dead,Act)] = {N,Act)\a 

holds up to net isomorphism. For the remaining identities in the first set, we first note that 
all of the refinement nets satisfy the property that for every reachable marking under which 
a -^/-labeled transition is enabled, no non--^/-labeled transition is enabled under that marking. 
It is straightforward to see that the r-labeled transitions resulting from hiding these -^/-labeled 
transitions during action refinement thus do not create any extra failure sets. The identities 
then follow easily. 

For the second set of identities, we note for all nets of the form (JV; \J , Act), the r-labeled 
transitions resulting from hiding the -^/-labeled transitions during action refinement do not 
create any extra failure sets. The identity for Am then follows easily. It is straightforward to 
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show that start-unwinding preserves [-J^^-meanings, from which the identity for sequencing 
follows easily. Finally, it is easy to see that the different cross-products of ^/-labeled transitions 
in the identity for parallel composition do not affect l/]™^ equality. 

To prove the distributive properties, it is easy to see that the identities for sequencing and 
non- communicating parallel composition hold up to net isomorphism. The identity for -\- M 
follows easily from the definitions of start-unwinding and action refinement. ■ 

Our definition of refinement generalizes the definitions of refinement given by Vogler [47] 
and van Glabbeek/Goltz [41] in the sense that our refined net is [-J^^-equivalent to their nets. 
In fact, there is an even tighter relationship between them, namely, these nets are equivalent 
up to a weaker form of history-preserving bisimulation [39] which treats r-moves as hidden and 
respects concurrent divergences. We omit the definition here since it is not necessary in our 
development. Since Vogler and van Glabbeek/Goltz use a cross-product construction on the 
"accept" places of their refinement nets rather than using r-moves to transfer control back to 
the target net, our refined net is not quite strongly history-preserving bisimilar to their nets. 
However, if we attach a single ^/-labeled transition to their set of accept places, we obtain 
nets which satisfy the property that for every reachable marking under which a ^/-labeled 
transition is enabled, no non--^/-labeled transition is enabled under that marking. Thus, the 
r-labeled transitions resulting from hiding these ^/-labeled transitions during action refinement 
do not create any extra failure sets. We note, however, that van Glabbeek/Goltz do not impose 
finiteness conditions on their nets since they do not have a hiding operation. Vogler imposes a 
more liberal finiteness condition than ours since his action refinement operator does not allow 
refinement nets to have "initial concurrency". 

We note that our definition of action refinement preserves finiteness of nets, and thus, in the 
same spirit as our full class of RWT nets, we can allow arbitrary finite RWT nets to function 
as both target nets and refinement nets. The class of finite RWT nets is also closed under all 
of the net operations presented in Chapter 2, including CSP-style parallel composition. 

5.2 Semantics for Action Refinement 

Since RWT Nets by definition are a subclass of WT Nets, all of the net semantics developed 
in Chapter 3 are well-defined on RWT Nets. This section shows that all of these semantics are 
compositional for action refinement, except for [.] MUST and [-] TEST . 

Proposition 5.2.1 [.] MUST and [•] TEST are not compositional for RWT Nets as either targets 
or operators of action refinement. 

By Theorem 3.2.47, [•]™ i t3j,-equality implies [-] TEST -equality. The proposition is then a 
simple consequence of Proposition 3.2.33 and Proposition 5.1.8. 

The following definitions will be useful in proving the compositionality of the other seman- 
tics. 

Definition 5.2.2 Let p be a pomset over an alphabet Act, let A C Act —{y/}, and let / map 
every event e in p whose label is in A to some (possibly empty) pomset p e over Act. The pomset 
q = p[A:=/] is defined as: 
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• Events^ = {(e, *) : e £ Events^ and l p (e) £" A} 



U {(e,e') : e £ Events^, l p (e) £ A and e' £ Events Pe }. 

• l q ((e, *)) = / p (e) and / g ((e, e')) = / Pe (e'). 

• For all (ei,ai), (e 2 ,a 2 ) £ Events^, (ei,ai) < g (e 2 ,a 2 ) iff either ei < p e 2 or (ei = p e 2 , 
lp(ei) £ A, and o^ < Pe a 2 ). 

If A is a singleton set {a}, we write p[a:=/] to denote p[{a}:=/]. 

Since non-maximal events in a pomset-trace of a target net represent "fully fired" transitions, 
we must be careful to replace them only with "successfully terminated" pomset-traces of the 
refinement nets. The following definition reflects this fact: 

Definition 5.2.3 Let PT and PT a be sets of pomsets over a common alphabet, Act, and let 
a £ Act-{y/}. Then: 

(PT, Act)[a: = (PT a , Act)] = augment ({p[a:=f] : p £ PT and / maps every a-labeled event e in p 

to some pomset p e in PT a such that 
if e £" max(p) then p e ; yj £ PT a }) 



Definition 5.2.4 Let p be a pomset over an alphabet Act, let _D p be a (possibly empty) set 
of downward- closed subsets of Events^, and let A C Act. Let g map every event e in p whose 
label is in A to some pair (p e , D e ), where p e is a (possibly empty) pomset over Act and D e is a 
(possibly empty) set of downward- closed subsets of Events Pe . Then (q,D q ) = (p,D p )[A:=g] is 
defined as: 

• q = p[A:=f], where dom(f) = dom(g) and /(e) = p e (= fst(g(e))) for every event 
e £ dom(g). 

• D q = {down q ({(e, a) £ Events^ : e £ d}) : <i £ D p } 

U {<io«?n g ({e} X d) : e £ Events^, l p (e) £ A, d £ D e , and rf ^ 0} 

U {down q ({(e' , a) £ Events^ : e' < p e}) : e £ Events^, / p (e) £ A, and £ _D e } 

Since a -labeled events of dupl-split nets represent "fully fired" transitions, we must be care- 
ful to replace them only with "successfully terminated" pomset-traces of the refinement net. 
Similarly, since c^-labeled events of dupl-split nets represent "half fired" transitions, we must 
be careful to replace them only with "non-terminated" pomset-traces of the refinement net. 
Furthermore, in order to be sure that the failure sets corresponding to these non-terminated 
pomset-traces remain valid after refinement, we require that these failure sets contain y/; this 
ensures that new actions do not become ready by "looking through" the r-transition corre- 
sponding to successful termination. As in the semantic definition of CSP-style parallel com- 
position, we only refine 1-2-respect'mg pomsets to avoid confusion between "non-matching" cii 
and a 2 -labeled actions. 

As evidenced by Proposition 5.1.8, hiding is definable from action refinement. More gener- 
ally, refining a-labeled transitions with any net that can successfully terminate after firing some 
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finite sequence of r-transitions will have the possible effect of hiding the a-labeled transitions, 
and hence may create additional divergences. In order to simplify our definition of action refine- 
ment on sets of pomset-failures and pomset-divergences, we first define a replace operator that 
ignores the effects of hiding on pomset-divergences (but does account for the independent effects 
on pomset-failures). Using this replace operator, we then define a semantic action refinement 
operator that properly accounts for all the effects of hiding. 

Definition 5.2.5 Let Act be a finite alphabet containing the distinguished symbol y/, let 

Act' = {ai : a G Act -{y/} and < i < 2} U {7, y/}, and let a G Act -{y/}. Let PF, PF a be 

sets of pomset-failures over Act', and let PD,PD a be sets of pomset-divergences over Act'. 
Then: 

(PF,PD,Act')[a replace {PF a , PD a , Act'}] d = {PF' , PD' , Act'}, where 

PF" = {(p[{a , ai }:=f],F') : (p, F p ) G l-2-respect(PF) for some F p , 

and / maps every event e in p with l p (e) G {a , a,i} 

to some pomset-failure (p e ,F e ) in PF a such that 

if (y/,<H)ePF a then a eF p , 

if l p (e) = a then {p e ; y/, 0) G PF a , 

if l p (e) = ai then y/ G F e and p e contains no ^/-labeled events, 

and F' C (F p U X) n fl {F e ■ l P (e) = aj, 

where X = {a ,ai,a 2 } — init(PF a )} 



PD" = {{p, D p )[{a , ai}:=5] : {p, D p ) G l-2-respect{PF) U l-2-respect{PD), 

D p is a (possibly empty) set of downward- closed subsets of Events^, 
g maps every event e in p with l p (e) G {a , a{\ 
to some (p e ,D e ) in PF a U PD a such that 

D e is a (possibly empty) set of downward- closed subsets of Events Pe , 
D p U Ul-^e : e ^ dom(g)} is non-empty, 
and if l p (e) = a then (p e ; y/, 0) G PF a } 



PF' = augment(0-split(PF")) U implied- ] 'allures Act t(PD') 
PD' = augment( extend Act i(0-split(PD"))) 

We now define the semantic action refinement to reflect the hiding behavior of action re- 
finement: 

Definition 5.2.6 Let Act be a finite alphabet containing the distinguished symbol y/, let 
Act' = {ai : a G Act -{y/} and < i < 2} U {7, y/}, and let a G Act -{y/}. Let PF, PF a be 
sets of pomset-failures over Act' , and let PD,PD a be sets of pomset-divergences over Act' . 
Furthermore, let a' be an action not in Act U Act' . The following definitions use the operations 
presented in Definition 3.2.45 and Definition 5.2.5. 
If (^,®)?PF a ,then 

{PF, PD, Act')[a: = {PF a , PD a , Act'}] = f {PF, PD, Act')[a replace {PF a , PD a , Act'}] 
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Otherwise, if <V, 0) £ PF a , then 

(PF, PD, Act')[a:=(PF a ,PD a ,Act')] 

def 

(((choice( ayayal) ({PF,PD,Act') grow {a'})) hide a') shrink Act')[a replace (PF a ,PD a , Act')] 

We now show that our [-] MAY , [•]^u t s I, and l/]™^ semantics are compositional for nets as 
targets and operators of action refinement. As discussed in the Introduction, this is in contrast 
to the semantics of [47], which is not compositional for nets as action refinement operators. 

Theorem 5.2.7 [-] MAY , [-]^ t ^, and [ ■]£*£* are compositional for RWT Nets as targets and 
operators of action refinement. 

Proof. Let Act be a finite alphabet containing y/, let a £ Act — {y/}, and let (JV, Act), {N a , Act) 
be RWT Nets. 

To prove compositionality of the [-] MAY semantics, we first observe that as a simple conse- 
quence of Lemma 5.1.5, Lemma 5.1.6, and the definition of pomset-traces and pomset-runs, 

pomset-traces((N , Act)[a: = (N a , Act)]) = 

{p[a:=f] : p £ pomset-traces((N , Act)) and / maps every a-labeled event e in p 
to some pomset p e in pomset-traces((N a , Act)) such that 
if e £" max(p) then p e ; y/ £ pomset-traces((N a , Act))} 

The details are straightforward and are left to the reader. 
It is now easy to see that 

{{N,Act)[a:={N a ,Act)T^ = [<JV,^)] MAY [a:=l(N a ,Act)} MAY ], 

where the action refinement operation on the right-hand side of the equation is that given in 
Definition 5.2.3. 

We now prove compositionality of the [-]^ t s I semantics. For the first case, suppose that 
{\/,9) (j£ fst(l(N a , Act)} 1 ^^). As a consequence of Lemma 5.1.5, Lemma 5.1.6, and the defini- 
tion of pomset-runs, pomset-traces, pomset-failures, and pomset-divergences, we have 

pomset-failures((N , Act)[a: = (N a , Act)]) = 

0-spUt({(p[{a ,ai}:=f],F') : {p,F p ) £ l-2-respect(pomset-failures((N, Act))) for some F p , 

and / maps every event e in p with l p (e) £ {a , ai} 
to some pomset-failure (p e ,F e ) of (N a ,Act) such that 
if l p (e) = a then (p e ;y/, 0) £ pomset-failures((N a , Act)), 
if l p (e) = ai then y/ £ F e and p e contains no -^/-labeled events, 
and F' C (F p U X) |~| fl {F e ■ l P {e) = «i}, 
where X = {a ,ai,a 2 } — init(pomset-failures((N a ,Act)))}) 
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pomset-divergences((N , Act)[a: = (N a , Act)]) = 

0-split({(p, D p )[{a , cii}:=g] : D p is a (possibly empty) set of downward- closed subsets of Events^, 
(p,D p ) G l-2-respect(pomset-failures((N,Act)))U l-2-respect(pomset-divergences((N , Act))), 
g maps every event e in p with l p (e) G {a , a,i} 

to some (p e ,D e ) in pomset-failures((N a , Act)) U pomset-divergences((N a , Act)) 
such that _D e is a (possibly empty) set of downward- closed subsets of Events Pe , 
D p U Ul-^e : e £ dom(g)} is non-empty, 
and if / p (e) = a then {p e ',\/, 0) G pomset-failures((N a , Act))}) 

The details are straightforward but tedious and are left to the reader. 
We now show that for the case when (^/, 0) G - fst({{N a , Act)}^^), 



[(N,Act)[a:=(N a ,Act)]\Y™ = [(N,Act)]?™ [a:=[(N a ,Act)]Y™] 



where the action refinement operation on the right-hand side of the equation is that given in 
Definition 5.2.6. 

One direction is a simple consequence of the definition of [-]^ t s I, Definition 5.2.6, and the 
highlighted equality above for the pomset-failures and pomset-divergences of the refined net. 
For the other direction, let (r,D r ) G snd(l(N,Act)}^^[a: = l(N a ,Act)}^^); then (r,D r ) G 
augment(extendAct({q,D q ))) for some pomset-divergence (q,D q ) such that (q,D q ) = 
(qi,D qi )[{a ,cii}:=g] for some (qi,D qi ) G |[{iV, ^4ci)|^;J[ t s ^ and some g mapping a -labeled and 
c^-labeled events e of q± to [(iV a , ^4c£)Kiit S -7- In turn, (qi,D qi ) G augment( extend A c t({Pi,D Pl ))) 
for some (pi,D Pl ) that is a pomset-divergence/pomset-failure of N, and each g(e) 
G augment(extendAct({p e , D Pe ))) for some (p e ,D Pe ) that is a pomset-divergence/pomset-failure 
of N a . It is easy to show that (q,D q ) G augment(extendA c t({Pi, D Pl )[{a , a,i}:=g']), where g' is 
the restriction of g to a -labeled and c^-labeled events e of p±. Hence, the highlighted fact above 
together with the definition of [-]^ t ^ implies that (q, D q ) G snd({(N, Act)[a: = (N a , Act)]]™^). 
It now follows from Proposition 3.2.18 that (r,D r ) G snd(l(N,Act)[a: = (N a ,Act)]jf p m)! The 
proof for pomset-failures in (r,D r ) G fst(l(N,Act)}^f^[a: = l(N a ,Act)}^f^]) is similar and is 
left to the reader. 

The other case, when (y/, 0) G fst(l(N a , Act)} 1 ^^) , then follows from the above proof, Defi- 
nition 5.2.6, Theorem 3.2.46, and the following easily proved fact: if (^/, 0) G fst({(N a , Act)]™™?), 
then 

l(N,Act)[a:=(N a ,Act)]}™% 

(((choice (aiaia0 ([(iV,^cOr p ^ grow {a'})) hide a') shrink Act')[a replace l(N a ,Act)}%™] 
The details are left to the reader. ■ 
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In order to prove compositionality of the corresponding interval semantics, we will need the 
following facts about refining interval pomsets and interval pomset-divergences: 

Proposition 5.2.8 Let q be an interval pomset such that q £ augment (p[a: = /]) for some pom- 
set p and function / mapping a-labeled events in p to pomsets. Then q £ augment (p' '[a:= /']) 
for some interval pomset p' y p and some function /' mapping a-labeled events in p' to interval 
pomsets such that /'(e) y /(e) for all e £ dom(f). 

Proposition 5.2.9 Let (q,D q ) be an interval pomset-divergence such that 
(q,D q ) £ augment ((p, D p )[A:=g]) for some pomset-divergence (p,D p ) and function g mapping 
events in p with labels in A to pomset-divergences. Then (q,D q ) £ augment((p' , D p i)[A:=g']) 
for some interval pomset-divergence (p 1 , D p i) y (p, D p ) and some function g' mapping events in 
p' with labels in A to interval pomset-divergences such that g'(e) y g(e) for all e £ dom(g). 

Using Lemmas 3.3.7 and 3.3.8 to account for the possible hiding effect of action refinement, 
the proofs of the propositions are straightforward and left to the reader. 
We now have: 

Theorem 5.2.10 The {•}££[, [•]££?*, and [-]^ V S J 7 are compositional for RWT Nets as targets 
and operators of action refinement. 

Proof. Let Act be a finite alphabet containing y/, let a £ Act — {y/}, and let (JV, Act), {N a , Act) 
be RWT Nets. 

We show that the following identities hold, where operations on the right-hand side of the 
equations are those given in Definition 5.2.3 and Definition 5.2.6. 



{(N,Act)[a: = (N a ,Act)]j™ = tntervals(l(N , Act)}™ [a: = {(N a , Act)]™]) 
l(N,Act)[a: = (N a ,Act)]]%™ = intervals(l(N , Act)]%™ [a: = l(N a ,Act)]%™]) 



The identity for [-]^y is a simple consequence of the augmentation- closure of the [-] MAY 
semantics, Theorem 5.2.7, and Proposition 5.2.8. 

It is easy to see that one direction of the equation for [•] 1 ^f.T follows easily from Theo- 
rem 5.2.7 and the monotonicity of the action refinement operation. For the other direction, let 
(r,D r ) £ snd(l(N, Act)[a: = (N a , Act)]J^J[]L); then (r, D r ) £ intervals^ augment^ extend Act({p,D p )))) 
for some pomset-divergence (p, D p ) oi(N, Act)[a: = (N a , Act)]. By Lemma 3.2.15 and Lemma 3.3.9, 
there is some interval pomset-divergence {q,{d'}}) such that (r,D r ) £ augment ( extend Act({q,{d'}))), 
q is an augmentation of a prefix of p and d! D d for some d £ D p . By Proposition 3.2.14, 

(q, {d 1 }) £ extendAct(augment(pomset-divergences((N, Act)[a: = (N a , Act)]))). 

It then follows easily from the highlighted fact in the proof of Theorem 5.2.7 that (q, {d 1 }) £ 
extend Act{augment( 0- split([p' , D p i)))) for some (p',D p >) £ (p l7 D 1 )[{a , a,i}:=g], where (pi,Di) 
is an appropriate pomset-divergence or pomset-failure and g is a suitable function. 
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It follows from Lemma 3.3.9 and Proposition 5.2.9 that there are some interval pomset- 
divergences (q',D q >) y (p',D p i), (qi,D qi ) y (pi,Di) and g'(e) y g(e) for all e G dom(g), such 
that (q, {d 1 }) G extendAct{augment(0-split([q' , D q i)))) and (q' , D q i) G augment((qi, D qi )[{a , cii}:=g']). 
From the definition of 0-split and augment and Lemma 3.2.16, it is easy to see that 

(q,{d'}) G augment( extend Act{0-split([qi, D qi )[{a , ai}:=g']))). 

The desired equality then follows easily. The proof for pomset-failures is similar, except that it 
uses Proposition 5.2.8 as well. ■ 

We then have: 

Theorem 5.2.11 The [-]^ A J, [-]^^, and H™^ semantics are respectively fully abstract for 
MAY-equivalence, MUST-equivalence, and Testing-equivalence with respect to alphabet expan- 
sion and action refinement. 

Proof. It is easy to see from the definitions of the H™^ and J-]™^ that [• ^in- 
equality implies [•]™ v s 1 3L-equality. Thus, Proposition 5.1.8 shows that split refinements, choice 
refinements, and CCS choice can be defined from action refinement up to [-J^^-equality. The 
theorem is then a simple consequence of Theorem 3.3.11 and Theorem 5.2.10. ■ 



5.3 The Semantic Domains Revisited 

All of the semantic domains, except for T>^ t ST and X>™ t ST , developed in Chapter 4 are closed 
under the appropriate action refinement operators given Definition 5.2.3 and Definition 5.2.6. 
Furthermore, these action refinements operators are continuous functions on the corresponding 
domains. 

Tl, onr . om C Q 1 Tlio T) MAY -r)MUST-split-7 ^-.TEST-split-7 -j-jMAY-intvl 7-)MUST-intvl- 7 i ^-.TEST-intvl-7 

ineorem o.«i.± ine u Act , u Act , , u Act ^ Act , , u Act , u Act , , ana u Act ^ Act , 

domains are closed under action refinement. Furthermore, action refinement is a continuous 
function on all of these domains. 

Proof. The proof that the domains are closed is straightforward but tedious; the details 
are left to the reader. 

The continuity of action refinement on V^^ and and pMAY-mtvi - 1S com pl e tely routine to 
verify, as is the continuity for the other domains when (-^/, 0) is not in the failure set of the 
refinement operator. The general case is then a simple consequence of Definition 5.2.6 and 
the continuity of alphabet expansion and shrinking, choice refinements, and hiding, which were 
proved in Chapter 4. ■ 
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Chapter 6 

Deciding True Concurrency 
Equivalences 

6.1 Introduction 

The computational complexity of the equivalence problem for nondeterministic finite-state au- 
tomata under a variety of standard process semantics has been tightly characterized. In partic- 
ular, trace equivalence and failure equivalence [8] are PSPACE-complete [26], while bisimulation 
[30] is PTlME-complete [4, 26]. It has been shown recently that these equivalence problems 
are exponentially harder for automata presented as finite "Mazurkiewicz nets" of synchro- 
nized state-machines [35]: namely, trace equivalence and failure equivalence of these nets are 
EXPSPACE-complete [29, 34] and bisimulation of these nets is DEXPTlME-complete [36]. 

The known results for "true" concurrency equivalences are much more limited. Vogler 
[46, 48] has shown the decidability of history-preserving bisimulation [5, 35, 39, 50, 46] and 
maximality-preserving bisimulation [13, 50] for finite 1-safe Petri nets; however, their complex- 
ity remained open. Decidability of such a basic true concurrency property as pomset-trace 
equivalence [39] appears not to have been known. (An ordinary trace is a linear sequence of 
visible actions; pomset-traces generalize these to multi-sets of actions partially ordered to reflect 
causality and concurrency.) 

In contrast to trace equivalence, the decidability of pomset-trace equivalence for finite nets 
does not obviously reduce to equivalence of finite automata. The difficulty is that if a run of a 
net has a pomset-trace isomorphic to the pomset-trace of a run of another net, then whether a 
transition firable after one run yields the "same" pomset extension as a transition firable after 
the other run depends a priori on the entire pomset trace, which may be unboundedly large. 
Hence instead of searching for a suitable equivalence relation on the finite set of net markings, 
one has to consider equivalence relations on a potentially infinite set of pomset traces and final 
markings. 

A similar difficulty appears in deciding whether finite nets are history-preserving bisimilar, 
which Vogler [46, 48] overcomes by maintaining, instead of an entire pomset history, a partial 
order on the fixed set of places of the nets that reflects "most-recent" firings. We use a similar 
partial order, but instead of places, we find it technically smoother to keep track of the partial 
ordering between the most-recent firings of transitions. This idea leads to a decision procedure 
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Class 


Equivalence 


Complexity 


Traces 


Traces 


EXPSPACE-complete 


Step-traces [25, 37, 39] 


ST-traces [39, 42] 


Interval-pomset-traces [23, 47] 


Pomset-traces [23, 39, 47] 


Failures/ 
divergences 


Failures [9] 


EXPSPACE-complete 


Step-failures [25, 37, 39] 


ST-failures [39, 42] 


Interval-pomset-failures [23, 47] 


Bisimulation 


Bisimulation [30] 


DEXPTlME-complete 


Delay bisimulation [43] 


Branching bisimulation [43] 


Step-bisimulation [25, 39] 


ST-bisimulation [39, 42] 


History-preserving Bisimulation 

[5, 35, 39, 50, 46] 


Maximality-preserving-bisimulation [13] 


Pomset-bisimulation [6] 


DEXPTlME-hard 
and in EXPSPACE 


Pomset-ST-bisimulation [50] 


DEXPTlME-hard 
and in EXPSPACE 



Table 6.1: Complexity results for finite 1-safe Petri Nets 

for pomset-trace equivalence, and a simple analysis of this procedure yields an EXPSPACE upper 
bound. 1 The same approach also gives a DEXPTIME decision procedure for history-preserving 
bisimulation. 

Our lower bounds for these true concurrency equivalences follow easily from reductions 
from the corresponding interleaving equivalences, whose lower bounds in turn essentially follow 
from the results of [29, 34, 36]. We thus obtain a tight bound of EXPSPACE-completeness for 
pomset-trace equivalence. Likewise, we obtain DEXPTlME-completeness for history-preserving 
bisimulation and maximality-preserving bisimulation, settling questions left open by Vogler 
[46, 48]. 

Our methods also yield tight complexity bounds for several other true concurrency equiva- 
lences, summarized in Table 6.1. In particular, our EXPSPACE-completeness results for ST-traces 
and ST-failures solve problems left open by Vogler [49], who had earlier proved the decidabil- 
ity of these equivalences. Furthermore, our decidability results for pomset-bisimulation and 
pomset-ST-bisimulation settle questions alluded to by Vogler [45]. 

This chapter is organized as follows. Section 6.2 describes our alternate characterization 
of pomset-trace equivalence, together with an EXPSPACE decision procedure. Similar analyses 



For expository purposes, we refer to bounds of the form 2 ^" ' for fixed k as exponentialm n. In the results 
presented here, k is at most 4. 
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of history-preserving bisimulation and pomset bisimulation are given in Section 6.3, while Sec- 
tion 6.4 describes decision procedures for the other equivalences. Section 6.5 gives lower bounds 
for all these equivalences. A discussion of some open problems appears in Section 6.6. 

6.2 Deciding Pomset-Trace Equivalence 

Throughout this chapter, we use the term nets to refer to marked, 1-safe Petri Nets [46] whose 
transitions have labels from a fixed set ActU{r}, where Act is a set of "visible actions" and 
t g - Act is the "hidden action." A transition is visible (hidden) iff its label is visible (hidden). 
The runs of a net are its finite firing sequences [46]. A net is finite iff it has a finite number of 
places and transitions; the size of a net is the total number of its places and transitions. 

Definition 6.2.1 A pomset is a labeled partial order. Formally, a pomset, p, consists of a 
set Events^ whose elements are called events, a set Labels^ whose elements are called labels, a 
function label p : Event s p ^ Lab els p , and a partial order relation < p on Events^. A function / is 
an isomorphism between pomset p and pomset q iff it is a label-preserving order-isomorphism, 
namely, 

• /: Event s p ^ Event s q is a bijection, 

• labelp = label g o /, 



• 



e < p e' iff /(e) < q f(e') for all e, e' G Events^. 



The places of a transition t of a net N are the places directly connected to it, i.e., the union 
of the preset and postset of t. Let t x ,t 2 be transitions of a net N. We say that t x and t 2 are 
statically concurrent in N iff the places of t x are disjoint from the places of t 2 . 

A transition-sequence, r, is a sequence of transitions of a net N. The transition-pomset of r 
has as events the integers from 1 to n, where the label of event i is i, and the partial ordering 
is the transitive closure of the following "proximate cause" relation: event i proximately causes 
event j iff i < j and i, and tj are not statically concurrent in N , cf. Figure 6-1. 

The visible-pomset of r is the transition-pomset of r, restricted to events labeled with visible 
transitions; moreover, in the visible-pomset, the label of event i is the label of i, (rather than i 8 - 
itself), cf. Figure 6-1. The pomset-traces of N are the visible-pomsets of runs of N. 

For transition-pomsets and visible-pomsets, it is traditional to say that event e causes event 
e' iff e < e' in the partial order. 

Definition 6.2.2 Let N and N' be nets. Then N pomset-trace approximates N 1 , written 
N Ept N', iff every pomset-trace of N is isomorphic to some pomset-trace of N'. N and N' 
are pomset-trace equivalent iff each is C p ^ the other. 

The runs of a finite net are clearly recognizable by a finite state automaton, namely, the 
"global state" automaton of the net itself. We represent an ordered pair r = t x ■ ■ -t n , r" = 
t'l . . .t'n, of transition-sequences of the same length as an input string (ti,t'() . . .(t n ,t") for an 
automaton whose alphabet is ordered pairs of transitions. So an "obvious" solution to the 
pomset-trace equivalence problem would be to define an effective procedure that, given any 
two finite nets as input, computes a finite-state automaton whose language consists of all the 
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5:ti 



1X1 

4:a 5:a 

Pomset-trace of r 



Transition-pomset of r 



Run r 



Figure 6-1: An Example of a Transition-pomset and Pomset-trace 



t 2 :b. 





N 



Figure 6-2: An Example 



pairs of runs of the respective nets that have isomorphic pomset-traces. Such an automaton 
would easily yield a decision procedure for pomset-trace equivalence, since we could project the 
language it accepts onto the components of the pairs and check that the resulting languages 
include the set of runs of the respective nets. 

However, such a finite-state automaton does not exist; the difficulty is that pairs of runs 
with isomorphic pomset-traces may generate the pomset-traces in different order, one getting 
unboundedly behind the other before catching up at the end. For example, let N be the net 
pictured in Figure 6-2. Then two runs of N have the same pomset-trace iff they have the 
same number of occurrences of a- and 6-labeled transitions, and the set of such pairs of runs is 
obviously not finite-state recognizable. 

We will show in this section that it suffices to consider pairs of runs that are "synchronous" 
in the sense that their behavior corresponds at each pair of transitions. We say that two runs 
r' and r" are equivalent up to concurrency iff they have isomorphic transition-pomsets. We will 
show that: 

• For all pairs of runs r and r' with isomorphic pomset-traces, there is a run r" that is 
equivalent to r' up to concurrency, and r and r" are "synchronous." 

• The set of pairs of synchronous runs is recognizable by a finite automaton with size 
bounded by an exponential in the sizes of the nets. 

Our decision procedure for pomset-trace equivalence is based on constructing such a finite- 
state automaton. To simplify the exposition, we consider first the case without hidden transi- 
tions. Our proofs will use the following fact about transition-pomsets: 
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Definition 6.2.3 A pomset p' is a linearization of a pomset p iff it has the same events and 
labels as p and < p < is a total ordering that contains < p . Let q be a pomset such that < q is 
a total ordering. Then for any 1 < i < | Event s 3 |, the i th largest event of q is the (necessarily 
unique) event e £ Events^ such that the longest chain e x < q . . . < q e k < q e in q is of length i. 

Let r = tit 2 ... be a transition-sequence of a net JV; we write \r\ for the length of r, and for 
any 1 < i < \r\, we write r[i] to denote the i th element, i,, of r. 

Proposition 6.2.4 Let r be a run of a net JV, let p' be a linearization of the transition-pomset 
of r, and let r' be the transition-sequence corresponding to p' , i.e., r' = t x ■ ■ -t\ r \, where each i 8 - 
is the label of the i th largest event of p' . Then r' is a run of N reaching the same final marking 
as r. 

The proposition is easily proved by induction on the number of pairs (i,j) such that i < j 
but the i th event of p' is larger (in the standard integer ordering) than the j th event of p' . The 
details are left to the reader. 

6.2.1 Nets without Hidden Transitions 

In this section, we assume that nets do not contain hidden transitions. 

Definition 6.2.5 Let r and r' be transition-sequences of nets N and N', respectively. We 
say that r and r' are synchronous iff the identity function on {1,2, . . ., \r\} is an isomorphism 
between the visible-pomset of r and the visible-pomset of r'. 

In particular, if r and r' are synchronous, then they are of the same length. 
We then have: 

Lemma 6.2.6 Let r and r' be runs of nets N and N', respectively. If the pomset-traces of r 
and r' are isomorphic, then there is some run r" of N' such that 

• r' and r" are equivalent up to concurrency, and 

• r and r" are synchronous. 

Proof. Let / be the isomorphism between the pomset-trace of r and the pomset-trace of 
r'. Since in this section we assume that nets do not contain hidden transitions, clearly r and 
r' are of the same length. Let r" be the transition- sequence obtained from r' by applying / 
element-wise to r; that is, r"[i] = r'[I(i)] for all 1 < i < \r'\. 

It follows easily from the definition of r" that / is a label-preserving bijection between the 
transition-pomsets of r" and r'. To show that / is an order-isomorphism, it clearly suffices to 
show that / and J -1 preserve proximate causes. Let event i be a proximate cause of event j 
in the transition-pomset of r". Then i < j, and transition r"[i] and transition r"[j] are not 
statically concurrent in N'; hence transition r'[I(i)] and transition r'[I(j)] are not statically 
concurrent in N'. I(j) < I(i) would imply that event I(j) is a proximate cause of event I(i) 
in the pomset-trace of r'; since / is an isomorphism between the pomset-trace of r and the 
pomset-trace of r' , it would follow that event j causes event i in the pomset-trace of r, and 
therefore that j < i, a contradiction. Hence I(i) < I(j), and so event I(i) is a proximate cause 
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of I(j) in the transition-pomset of r', proving this direction. The proof of the other direction is 
similar and omitted. This completes the proof that r' and r" are equivalent up to concurrency; 
that is, they have isomorphic transition-pomsets. 

Every transition-sequence corresponds to a linearization of its transition-pomset, by defi- 
nition. Since r' is a run, and r' and r" have isomorphic transition-pomsets, Proposition 6.2.4 
immediately implies that r" is a run of N'. 

Clearly, J -1 is an isomorphism between the pomset-trace of r' and the pomset-trace of r". 
Pomset isomorphisms are closed under function composition; thus J -1 o I, i.e., the identity 
function on {1, . . . , |r|}, is an isomorphism between the pomset-trace of r and the pomset-trace 
of r" . This implies that r and r" are synchronous, completing the proof of the lemma. ■ 

An important property of synchronous transition- sequences is that their equal-length pre- 
fixes are also synchronous. 

Definition 6.2.7 Let p be a pomset and e,e' G Events^. Event e' is a maximal cause of event 
e in p providing e' < p e and there is no event e" G Events^ such that e' < p e" < p e. 

Proposition 6.2.8 Let r and r' be transition-sequences of length n > and let t and t' be 

transitions of nets N and N', respectively. Then r.t and r'.t' are synchronous iff 

• r and r' are synchronous, 

• t and t' have the same label, and 

• the maximal causes of event n + 1 are the same in the transition-pomsets of r.t and r'.t'. 

The proof is completely straightforward and is left to the reader. 

Thus, in determining whether two pomset-traces "grow" synchronously, it suffices to keep 
track of the correspondence between maximal causes. We now observe that all maximal causes 
will necessarily be the most-recent firings of the corresponding transitions. 

Definition 6.2.9 Let r = t x ■ ■ -t n be a transition-sequence of a net N. Event i is a most 
recent firing of transition t in r iff i, = t and tj j^ t for i < j < n. Let growth- sites(r) be the 
transition-pomset of r, restricted to the most-recent firings of the transitions in r, cf. Figure 6-3. 

Proposition 6.2.10 Let r = t x ■ ■ -t n be a transition- sequence and t be a transition of a net N. 
Then the maximal causes of event n + 1 in the visible-pomset of r.t are a subset of the events 
of growth- sites(r). 

Proof. Suppose event i of the visible-pomset of r.t is a maximal cause of event n + 1. 
Then by the definition of the causal partial ordering, event i must be a proximate cause of 
event n + 1, and hence transition i, must not be statically concurrent with t. Therefore any 
later firing of i,, that is, any event j with i < j < n and tj = ti, would also be a proximate 
cause of t. But since event i proximately causes any such event j, this would contradict event 
i being a maximal cause of event n + 1. ■ 

We also make the simple observation that the growth-sites of transition-sequence r.t are 
fully determined by t and the growth-sites of r: 
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Proposition 6.2.11 Let r be a transition-sequence and t a transition of a net N. Then 
growth- sites(r.t) = {i G growth- sites(r) : r[i] ^ t} U {|r.i|}. 

Proof. Clearly, event |r.i| is the most-recent firing of transition t in r.t. Furthermore, the 
most recent firing of any other transition t' is the same in r and r.t. m 

It now follows that whether two synchronous runs remain synchronous after firing another 
pair of transitions depends solely on the labels of these transitions, and on whether the causes 
of these transitions are the same in the growth-sites of the respective runs. It will be helpful 
to define a more general growth-site correspondence (gsc) between causes in growth-sites. To 
avoid confusion, we introduce the following terminology: 

Definition 6.2.12 Let p and q be pomsets and let f:p—*q be a partial function from Events^ 
to Events^. Then p is the source of /, written source(f), and q is the target of /, writ- 
ten target(f). Furthermore, the domain-of- definition of / is the subset of Events^ given 
by {e G Events^ : /(e) is defined}, and the image of / is the subset of Events^ given by 
|e' G Events^ : /(e) = e' for some e G Events^}. 

Definition 6.2.13 Let r = t x ■ ■ -t n and r' = t[ . . .t' m be transition-sequences of nets N and N', 
respectively. Then gsc(r, r') is defined iff r and r' are synchronous. Furthermore, if r and r' are 
synchronous, then gsc(r,r') is the partial identity function (3: growth-sites(r)—^growth-sites(r r ) 
such that (3{i) = j iff i = j and i G Events ffrou)iA . sl - ies(r) D Events growth _ site!<rl y cf. Figure 6- 
3. In particular, growth- sites(r) is the source of gsc(r,r r ), and growth- sites(r') is the target of 
gsc(r, r'). 

We now state the key observation underlying our decision procedure: the growth-site cor- 
respondence of a pair of runs r.t and r' .t' is determined up to isomorphism by the isomorphism 
class of the growth-site correspondence between r and r' . 

Definition 6.2.14 Let (3 and 7 be partial functions whose source and target are pomsets. We 
say that (3 and 7 are isomorphic, written (3 ~ 7, iff there is a pair of functions (/, J) such that 

• / is an isomorphism between source{(3) and source(j), 

• J is an isomorphism between target((3) and target(j), and 

• j o I = J o f3. 

Lemma 6.2.15 Let ri,r 2 be transition-sequences and t a transition of net JV; likewise for 
r[,r' 2 ,t' of net N'. If gsc(ri, r[) ~ gsc(r 2 ,r 2 ), then gsc(ri.t,r[.t') ~ gsc(r 2 .t,r 2 .t r ). 

Proof. Let (/, J) be the isomorphism between gsc(ri, r[) and gsc(r 2 , r 2 ), noting that both 
gsc(ri,r[) and gsc(r 2 ,r' 2 ) are defined. 
We define the function I' to be 

, ( . _ { \r 2 .t\ if i = |ri.i| 

~ \ I(i) if i e Events growth _ sttes(rit) and i ^ \r x .t\ 
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Figure 6-3: An Example of Growth-Sites and Growth-Site Correspondence 
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and define the function J' to be 

f It-' t'\ if i — It-' /'I 
j'( j\ — J I 2 I J ~~ I i I 

UJ ~ \ J(j) if J e Events ffrou)iA . sl - ies(r ,_ t , ) and j ^ K.f | 

By Proposition 6.2.11,/' and J' are total functions on Events„ rou) ^_ s ^ es(V t -, and Events q row ifi-sites(r' t')' 
respectively. Definition 6.2.9, Proposition 6.2.11, and the properties of/ and J imply that /' is 
an isomorphism between growth-sites(ri.t) and 

growth- sites(r 2 .t), and J' is an isomorphism between growth-sites(r[.t') and 
growth-sites(r' 2 .t ') . The details are left to the reader. 

In order to prove that gsc(r 2 .t, r' 2 .t')oI' = J' ogsc(ri.t, r' 1 .t'), we first show that gsc(ri.t, r' 1 .t') 
is defined iff gsc(r 2 .t, r' 2 .t') is defined. For one direction, suppose that gsc(ri.t,r[.t') is defined; 
thus, r\.t and r[.t' are synchronous and t and t' have the same label, Furthermore, since 
gsc(r 2 ,r 2 ) is defined, we have that r 2 and r 2 are synchronous and \r 2 \ = \r 2 \. By Proposi- 
tion 6.2.8, it remains to show that the maximal causes of event \r 2 .t\ are the same in the 
transition-pomsets of r 2 .t and r' 2 .t' . For one direction, let event A; be a maximal cause of event 
\r 2 .t\ in the transition-pomset of r 2 .t; Proposition 6.2.10 implies that k £ growth- sites(r 2 ). 
Since /is an isomorphism between growth-sites(ri) and growth- sites(r 2 ), it follows that / _1 (A;) £ 
growth- sites(ri) and that event I~ 1 (k) is a maximal cause of event |r"i.i| in the transition-pomset 
of ri .i; the details are straightforward but slightly tedious and are left to the reader. Since 
r\.t and r[.t' are synchronous, Proposition 6.2.8 implies that event I~ 1 (k) is also a maximal 
cause of event \r[.t'\ in the transition-pomset of r[.t' , r > ^[/ _1 (A;)] and t' are not statically concur- 
rent, and I~ 1 (k) £ growth-sites(r[) . Definitions 6.2.9, 6.2.13, and 6.2.14 and our definition of 
(I, J) then imply that r'^I -1 ^)] = r'^JlI -1 ^))] = r' 2 [k], and so r' 2 [k] and t' are not statically 
concurrent; hence, event k must cause event \r 2 .t'\ in the transition-pomset of r 2 .t' . The other 
direction is analogous, and so the maximal causes of event \r 2 .t\ are the same in the transition- 
pomsets of r 2 .t and r 2 .t' . Thus, by Proposition 6.2.8, r 2 .t and r 2 .t' are synchronous, proving 
that gsc(r 2 .t,r' 2 .t') is defined. The proof of the other direction, namely that gsc(ri.t,r' 1 .t') is 
defined whenever gsc(r 2 .t,r' 2 .t') is defined, is analogous and omitted. 

We now show that gsc(r 2 .t,r 2 .t r ) o /' = «/' o gsc(ri.t,r[.t r ). For one direction, let i be some 
event on which gsc(r 2 .t, r' 2 .t')oI' is defined. It then follows by Definition 6.2.13 and the definition 
of/' that i £ growth- sites(r \. i), I'{i) £ growth-sites(r 2 .t) n growth-sites(r' 2 .t') , and gsc(r 2 .t,r 2 .t r ) 
is defined; thus, by the above proof, gsc(ri.t,r' 1 .t') is defined, |r"i.i| = |^.i'|, and \r 2 .t\ = \r' 2 .t'\. 
For one case, suppose that i ^ \r-\_.t\; then I'(i) = I(i) j^ \ r ' 2 -t'\ an d thus by Proposition 6.2.11, 
i £ growth- sites(ri), I'(i) £ growth-sites(r 2 ) n growth- sites(r 2 ), and r' 2 [I'(i)] ^ t' . Since by 
assumption, gsc(ri, r[) and gsc(r 2 , r 2 ) are defined and gsc(r 2 , r 2 ) o I = J o gsc(ri, r[), it follows 
that (J o gsc(ri,r[))(i) = I'{i). Thus, i £ growth-sites(r[), I'{i) = J(i), and r[[i] = r 2 [J(i)] = 
r' 2 [I'(i)], and so r[[i] ^ t' . Proposition 6.2.11 then implies that i £ growth-sites(r' 1 .t'), and so 
J' o gsc(ri.t,r[.t r ) is defined on i. Furthermore, 

(gsc(r 2 .t, r' 2 .t') o I')(i) = (gsc(r 2 , r' 2 ) o T)(i) = (J o gsc(r u r' 1 ))(i) = («/' o gsc^.t, r' 1 .i'))(i), 

proving this case. The other case is similar and is left to the reader. The proof of the other 
direction is analogous. ■ 
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The size of the growth-sites of any transition- sequence of a net is obviously bounded by the 
number of transitions in that net. We can thus easily conclude that the number of isomorphism 
classes of growth-site correspondences between transition-sequences of nets N and N' is bounded 
by an exponential in the maximum of the number of transitions in N and N'. 

We thus have: 

Theorem 6.2.16 For any finite nets N and N', there is a deterministic finite-state automaton 
recognizing the set of pairs of synchronous transition-sequences of N and N'. If m and m' are 
the number of transitions in N and N', respectively, then the number of states in the automaton 
is bounded by c max i m > m } f or some fixed constant c > 1. 

Proof. The states of the automaton are the isomorphism classes of growth-site corre- 
spondences between transition-sequences of N and N'. A state (3 moves to a state 7 via a pair 
(i, t') of transitions iff (3 is the isomorphism class of gsc(r, r') and 7 is the isomorphism class of 
gsc(r.t,r'.t') for some transition-sequences r and r' of N and N', respectively. The start state 
is the isomorphism class of the empty function, and all states are accepting. By Lemma 6.2.15, 
this automaton is deterministic. 

If (ti,t[) . . .(t k ,t' k ) is in the language of the automaton, then by Lemma 6.2.15, the fi- 
nal state reached must be the isomorphism class of gsc(ti . . .t k ,t[ . . .t' k ). Hence, this growth- 
site correspondence is defined, and so t x ■ ■ -t k and t[ . . .t' k are synchronous. Conversely, if 
ti . . .t k and t[ . . .t' k are synchronous, then all their equal- length prefixes are synchronous, and 
so gsc(ti . . .ti,t[ . . .t'A is defined for all < i < k. Hence, by Lemma 6.2.15 and the definition 
of the automaton, (ti,t[) . . .(t k ,t' k ) is in its language. ■ 

Since the runs of a finite net are finite-state recognizable by the (necessarily deterministic) 
transition system of the net itself, and since finite-state recognizable sets are closed under 
intersection and renaming input symbols, we conclude: 

Corollary 6.2.17 For any finite nets N and N', there is a finite-state automaton whose lan- 
guage is the set of runs r of N for which there is some run r' of N' such that r and r' are 
synchronous. If m and m' are the number of transitions in N and N', respectively, and n 
and n' are the number of places in N and N', respectively, then the number of states in the 
automaton is bounded by rf max { m .™ } + max f"'" } for some fixed constant d > 1. 

Proof. The number of states in the deterministic automaton that recognizes the set of 
pairs of runs of N and N' is 5 max i n > n } fo r some fixed constant b > 1. The intersection of this 
automaton with that of Theorem 6.2.16 has number of states bounded by rf max { m > m } + max f"'" } 
for some fixed constant d > 1. Then renaming each input symbol (£,£') by symbol t does not 
change the number of states and yields the desired automaton. ■ 

It is fairly straightforward to show that such an automaton can in fact be constructed in 
space proportional to the size of its transition table. The desired decidability result then follows 
as a corollary: 

Theorem 6.2.18 The pomset-trace equivalence problem for finite nets without hidden tran- 
sitions can be decided in space exponential in the number of places and transitions in the 
nets. 
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Proof. By Lemma 6.2.6 and Corollary 6.2.17, N C p ^ N' iff the language of the finite-state 
automaton given in Corollary 6.2.17 is the set of all runs of N. It is easy to construct another 
finite-state automaton, of essentially the same size, recognizing the runs of N. So N C p ^ N' iff 
these automata recognize the same language. But language equivalence is checkable in space 
proportional to the size of the automata [22]. ■ 



6.2.2 Nets with Hidden Transitions 

We now show how the results above extend to nets which may contain hidden transitions. We 
begin by modifying our definition of "synchronous" to take account of hidden transitions. This 
new definition will coincide with Definition 6.2.5 for nets without hidden transitions. 

Definition 6.2.19 Let r = t x ■ ■ -t n and and r' = t[ . . .t' m be transition-sequences of nets N 
and N', respectively. 

Let a rr i be the partial function on the integers such that a rr i (i) = j iff i, is the k th transition 
of r with a visible label and t'- is the k th transition of r' with a visible label, for some (necessarily 
unique) k. 

Then r and r' are synchronous iff a rr i is an isomorphism between the visible-pomset of r 
and the visible-pomset of r'. 

In particular, if r and r' are synchronous, then they have the same number of occurrences 
of visible transitions. 

Lemma 6.2.6 continues to hold for this generalized notion of synchronous: 

Lemma 6.2.20 Let r and r' be runs of nets N and N', respectively. If the pomset-traces of r 
and r' are isomorphic, then there is some run r" of N' such that 

• the transition-pomsets of r' and r" are isomorphic, and 

• r and r" are synchronous. 

Proof. The proof extends that of Lemma 6.2.6. Let / be the isomorphism between the 
pomset-trace of r and the pomset-trace of r', and let q and q' respectively be the transition- 
pomsets of r and r'. Clearly, r and r' must contain the same number, k, of occurrences of 
transitions with visible labels. For 1 < i < k, we define vis r (i) to be the index of the i th 
visible transition-occurrence in r; that is, vis r (i) = m, where r[m] is the (necessarily unique) i th 
transition of r with a visible label. We let v be the sequence of visible transition-occurrences 
obtained from r' by applying /element-wise to visible transitions of r; that is, v[i] = r'[I(vis r (i))] 
for ah 1 < i < k. We then obtain r" by "padding" v with sequences w, of hidden transition- 
occurrences of r'; each composite sequence Wi . . . w, will contain exactly the hidden transition- 
occurrences of r' that are necessary for the v[l], . . -,v[i] to fire. In order to define the tc,-, we 
first define z,, for 1 < i < k, to be the ascending sequence of indices of the "remaining" hidden 
transition-occurrences that causally precede r'[I(vis r (i))]. Furthermore, we define z k+ i to be 
the sequence of indices of "left-over" hidden transition-occurrences of r' . 
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Zi = the ascending sequence over the set 

{j < q i I(vis r (i)) : r'[j] is a hidden transition and j <fi q i I(vis r (n)) for all n < i} 

z k+1 = the ascending sequence over the set 

{j < \ r '\ '■ r '[j] is a hidden transition and j <fi q i I(vis r (n)) for all n < k} 

We then define r" to be the sequence w±v [l]w 2 t> [2] . . .v [k]w k+ i, where each w, is the sequence 
of transition-occurrences of r' corresponding to z,; that is, |w 8 | = \zi\ and Wi[n] = r'[zi[n]] for 
all 1 < n < \zi\. Hence, for all 1 < i < k, r"[vis r "(i)] = v[i] = r'[I(vis r (i))]. 

Let 

I(vis r (vis~n{i))) if r"[i] is a visible transition 

C(i) = < if for some (necessarily unique) n and hidden transition t 

m r"[i] is the ra th occurrence of t in r", and 

r'[m\ is the ra th occurrence of i in r' 

It is straightforward but tedious to show that C is a label-preserving bijection between the 
transition-pomsets of r" and r'; the details are left to the reader. 

To show that C is an order-isomorphism, it clearly suffices to show that C and C _1 preserve 
proximate causes. Suppose that event i is a proximate cause of event j in the transition- 
pomset of r"; then i < j and transition r"[i] and transition r"[j] are not statically concurrent 
in N'. Then by definition of r" and C, transition ?"'[C(i)] and transition r'[C(j)] are not 
statically concurrent in N'. For one case, suppose that both r"[i] and r"[j] are visible transitions. 
C(j) < C(i) would imply that event C(j) is a proximate cause of event C(i) in the pomset- 
trace of r'; since / is an isomorphism between the pomset-trace of r and the pomset-trace of 
r', it would follow that event J _1 (C(j)) causes event J _1 (C(i)) in the pomset-trace of r, and 
so I~ l (C(j)) < I~ l (C(i)). Clearly, vis r and vis~,} are monotone functions, implying that j < i, 
a contradiction. Hence C(i) < C(j), and so event C(i) is a proximate cause of event C(j) in 
the transition-pomset of r', proving this case. 

For another case, suppose that r"[i] is a hidden transition t, and r"[j] is a visible transition. 
Then for some n, r"[i] is the ra th occurrence of i in r" and ?"'[C(i)] is the ra th occurrence 
of i in r'. Let n' be the number of occurrences of t preceding r"[j] in r"; clearly, n' > n 
since i < j. By definition of r", r"[j] = v[vis~,}(j)]; hence by definition of the Z{, there are 
distinct / l5 ...,/„/ in z . . -^ OT - s -i(,-) such that r"'[/i], . . .,r'[/ n /] is each an occurrence of t. Let / 
be the maximum of /i, .. .,/„<; from the definition of C and the z,, I > C(j) would imply that 
there is some j' < j such that r'[C(j')] is a visible transition and / < q i C(j'). Then, clearly, 
C(j) < q i I < q i C(j'), and so I(vis r (vis~n{j))) < q > I(vis r (vis~,} (j 1 ))) ■ Since / is an isomorphism 
between the pomset-traces of r and r' , it would follow that vis r (vis~,}(j)) < q vis r (vis~,}(j')), and 
so vis r (vis~,}(j)) < vis r (vis~n {]')). The monotonicity of vis r and vis~,} would then imply that 
j < j', a contradiction. Thus, / < C(j) after all; now, C(j) < C(i) would imply that there are 
n' > n occurrences of t preceding ?"'[C(i)] in r', contradicting the fact that ?"'[C(i)] is the ra th 
occurrence of t in r'. Hence C(i) < C(j), and so event C(i) is a proximate cause of event C(j) 
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in the transition-pomset of r', proving this case. 

The proofs of the other cases and the other direction are similar, and are left to the reader. 

The proof that r" is a run of N' is identical to that for Lemma 6.2.6. 

Clearly, vis r » o vis' 1 oI~ l is an isomorphism between the pomset-trace of r' and the pomset- 
trace of r". Pomset isomorphisms are closed under function composition; thus, vis T n o vis' 1 o 
I' 1 o I is an isomorphism between the pomset-trace of r and the pomset-trace of r". It follows 
easily from the definitions of a rr //, vis r , and vis T n that a TT n = vis T n o vis' 1 , proving that r and 
r" are synchronous, and completing the proof of the lemma. ■ 

The notion of maximal cause must now be sharpened to be a maximal visible cause. 

Definition 6.2.21 Let N be a net, let p be a transition-pomset of N, and let e,e' G Events^. 
Event e' is a maximal visible cause of event e in p providing l p (e') is a visible transition of N, 
e' < p e and there is no event e" G Events^ such that l p (e") is a visible transition of N and 

Then Proposition 6.2.8 generalizes as follows: 

Proposition 6.2.22 Let r,r' be transition-sequences and let t,t' be visible transitions of nets 
N,N', respectively. Then r.t and r' .t' are synchronous iff 

• r and r' are synchronous, 

• t and t' have the same label, and 

• a rr i restricted to the maximal visible causes of event \r\ + 1 in the transition-pomset of 
r.t is a bijection onto the maximal visible causes of event \r'\ + 1 in the transition-pomset 
of r'.t'. 

Also, if t is a hidden transition, then r.t and r' are synchronous iff r and r' are synchronous. 

The proof is completely straightforward and is left to the reader. 
The notion of growth-sites extends to hidden transitions as follows: 

Definition 6.2.23 Let r be a transition-sequence of a net N. Let most-recent(r) be the set of 
most recent firings in r of each transition. Let max-visible-causes(t, r) be the maximal visible 
causes (in the transition-pomset of r) of the most recent firing in r of transition t. Then 
growth- sites(r) is the restriction of the transition-pomset of r to 

most-recent(r) U \\{max-visible-causes(t, r) : i is a hidden transition}. 

As before, the maximal causes will necessarily be a subset of the events in the growth-sites: 

Proposition 6.2.24 Let r = t x ■ ■ -t n be a transition-sequence and t be a visible transition of 
a net N. Then the maximal causes of event n + 1 in the visible-pomset of r.t are a subset of 
the events of growth- sites(r). 
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Proof. Suppose event i of the visible-pomset of r.t is a maximal cause of event n + 1. For 
one case, suppose that event i is also a maximal cause of n + 1 in the transition-pomset of r.t; 
then i £ most-recent(r) by a proof identical to that of Proposition 6.2.10. For the other case, 
there must be some event k in the transition-pomset of r.t such that t k is a hidden transition, 
event i causes event k, and event A; is a maximal cause of event n + 1. It follows by the same 
reasoning as in the proof of Proposition 6.2.10 that event k must be the most-recent firing of 
transition t k in r. Therefore, event i not being in growth- sites(r) would imply that event i is 
not a maximal visible cause of event k. There would thus be some event j in the transition- 
pomset of r such that tj is a visible transition, event i causes event j, and event j causes event 
k. But this would contradict event i being a maximal cause of ra+1 in the visible-pomset of r.t. m 

We now observe that the growth-sites of transition-sequence r.t are fully determined by t, 
the growth-sites of r, and the static concurrency relation of JV: 

Proposition 6.2.25 Let r be a transition-sequence and t a transition of a net N. Then an 
event i is a visible cause of event \r.t\ in the transition-pomset of r.t iff i £ growth- sites(r), r[i] 
is a visible transition, and there is some event j £ growth- sites(r) such that transition r[j] and 
t are not statically concurrent, and either event i causes event j in growth- sites(r) or i = j. 
Furthermore, an event i is a maximal visible cause of event \r.t\ in the transition-pomset of r.t 
iff event i is a visible cause of event \r.t\ in the transition-pomset of r.t and there is no event 
k £ growth- sites(r) such that event i causes event k in growth- sites(r) and event A; is a visible 
cause of event \r.t\ in the transition-pomset of r.t. 

The proposition is a straightforward consequence of Proposition 6.2.10; the details are left 
to the reader. 

Proposition 6.2.26 Let r = t x ■ ■ -t n be a transition-sequence of a net N. Then most-recent(r) = 

{i £ growth- sites(r) : there is no event j £ growth- sites(r) 

such that j > i and / g row th-sites(r)\ l ) = ' growth- sites(r)U) ') 

Furthermore, max-visible-causes(t k , r) = 

{i £ growth- sites(r) : there is some event j £ most-recent(r) 

such that lg row th-sites( r )ti) = ** and 

event i is a maximal visible cause of event j 

in growth- sites(r)} 

The proposition is a simple consequence of Definition 6.2.23; the details are left to the 
reader. 

Proposition 6.2.27 Let r be a transition-sequence and t a transition of a net JV. Then 

growth- sites(r.t) = 

{\r.t\} U {i £ growth- sites(r) : either i £ most-recent(r) and r[i] 7^ i 

or i £ max-visible-causes(t' , r) 

for some hidden transition t' ^ t 
or i £ max-visible-causes(t, r.t) 

and i is a hidden transition} 
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Proof. Clearly, event \r.t\ is the most-recent firing of transition t in r.t, and the most- 
recent firing of any other transition is the same in r and r.t. Furthermore, the maximal visible 
causes of the most-recent occurrence of any hidden transition other than t are the same in the 
transition-pomsets of r and r.t, from which the highlighted equality immediately follows. ■ 

As an immediate consequence of the preceding three propositions, we have: 

Proposition 6.2.28 Let r be a transition-sequence and t a transition of a net N. Then 
growth- sites(r.t) is fully determined by t, growth- sites(r), and the static concurrency relation of 

N. 

Our definition of growth-site correspondences is also modified accordingly; this new defini- 
tion will coincide with Definition 6.2.13 for nets without hidden transitions. 

Definition 6.2.29 Let r and r' be transition- sequences of nets N and N' , respectively. Then 
gsc(r, r 1 ) is defined iff r and r' are synchronous. Furthermore, if r and r' are synchronous, then 
gsc(r,r') is the 1-1 partial function 
(3: growth-sites(r)—^growth-sites(r r ) such that 

graph(fi) = graph{a r y) |~| (Events (ffrou)iA . sl - ies(r)) X Events^^.^^^). 

In particular, growth- sites(r) is the source of gsc(r,r r ), and growth- sites(r') is the target of 
gsc(r, r'). 

Again, the growth-site correspondences are significant only up to isomorphism: 

Lemma 6.2.30 Let r\, r 2 be transition-sequences of net N and let r[, r' 2 be transition-sequences 
of net N' . If gsc(ri, r' : ) ~ gsc(r 2 , r 2 ), then 



• 



• 



• 



gsc(ri.t,r' 1 .t') ~ gsc(r 2 .t,r' 2 .t') for any pair of visible transitions t and t' of N and N', 
respectively. 

gsc(ri.t,r[) ~ gsc(r 2 .t,r 2 ) for any hidden transition t of N. 

gsc(ri,r' 1 .t') ~ gsc(r 2 ,r' 2 .t') for any hidden transition t' of N'. 



The proof is a straightforward but tedious adaptation of the proof of Lemma 6.2.15 and 
uses Definitions 6.2.1, 6.2.19, 6.2.23, and 6.2.29, and Propositions 6.2.22, 6.2.28, and 6.2.24, 
instead of the corresponding definitions and propositions in the previous section. The details 
are left to the reader. 

We note that it follows from Definition 6.2.23 that the size of the growth-sites of any 
transition-sequence of a net is bounded by the square of the number of transitions in that net. 

We remark that, in order to allow hidden transitions to move independently, the alphabet 
of the automaton of Theorem 6.2.16 is generalized to pairs (u,u r ), where either u and u' are 
both visible transitions of the respective nets, or exactly one of u and u' is a hidden transition 
of the respective net and the other is a special symbol •. We refer to any sequence w of such 
pairs as a •-pair-sequence, and for i = 1,2, we write proji(w) to denote the projection of w 
onto its i th component alphabet, with all occurrences of • omitted. 
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Theorem 6.2.31 For any finite nets N and N', there is a deterministic finite-state automaton 
recognizing the set of pairs of synchronous transition-sequences of N and N'. If m and m' are 
the number of transitions in N and N', respectively, then the number of states in the automaton 
is bounded by c max i m > m } f or some fixed constant c > 1. 

Proof. The states of the automaton are the isomorphism classes of growth-site corre- 
spondences between transition-sequences of N and N'. A state (3 moves to a state 7 via a pair 
(t, t 1 ) of transitions iff (3 is the isomorphism class of gsc(r, r') and 7 is the isomorphism class of 
gsc(r.t, r'.t') for some transition-sequences r and r' of N and N', respectively. A state (3 moves 
to a state 7 via a pair (i, •) iff (3 is the isomorphism class of gsc(r, r 1 ) and 7 is the isomorphism 
class of gsc(r.t,r') for some transition-sequences r and r' of JV and N', respectively; a similar 
definition applies to pairs (•,£'). The start state is the isomorphism class of the empty function, 
and ah states are accepting. By Lemma 6.2.30, this automaton is deterministic. 

If w = (ui, u[) . . .(u k , u' k ) is in the language of the automaton, then by Lemma 6.2.30, 
the final state reached must be the isomorphism class of gsc(proji(w) , proj^iw)) ■ Hence, this 
growth-site correspondence is defined, and so proji(w) and proj 2 (w) are synchronous. Con- 
versely, if proji(w) and proj 2 (w) are synchronous, then 

gsc(proji(w'),proJ2(w')) is defined for all prefixes w' of w. Hence, by Lemma 6.2.30 and the 
definition of the automaton, w is in its language. ■ 

As before, we conclude: 

Corollary 6.2.32 For any finite nets N and N', there is a finite-state automaton whose lan- 
guage is the set of runs r of N for which there is some run r' of N' such that r and r' are 
synchronous. If m and m' are the number of transitions in N and N', respectively, and n 
and n' are the number of places in N and N', respectively, then the number of states in the 
automaton is bounded by rf max { m .™ } + max f"'" } for some fixed constant d > 1. 

Proof. The number of states in the deterministic automaton whose alphabet consists of 
•-pairs and that recognizes the set of pairs of runs of N and N' is 5 max i n . n } fo r some fixed 
constant b > 1. The intersection of this automaton with that of Theorem 6.2.31 has number 
of states bounded by rf max { m .™ } + max f"'" } for some fixed constant d > 1. Then renaming each 
input symbol (£,£') by symbol t, renaming each input symbol (i, •) by t, and renaming each in- 
put symbol (•,£') by e does not change the number of states and yields the desired automaton. ■ 

The earlier argument without hidden transitions now carries over: 

Theorem 6.2.33 The pomset-trace equivalence problem for finite nets that may contain hid- 
den transitions can be decided in space exponential in the number of places and transitions in 
the nets. 

Proof. Since, language equivalence of automata with e-moves is decidable in space pro- 
portional to the size of the automata [22], the proof of the theorem is identical to that of 
Theorem 6.2.18, except that it uses Lemma 6.2.20 and Corollary 6.2.32. ■ 
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6.3 History-Preserving Bisimulation and Pomset-Bisimulation 

In this section, we assume that all nets may contain r-labeled transitions. We begin by defining 
history-preserving bisimulation on nets. Our definition induces the same equivalence as that of 
[5, 35, 39, 50, 46]. 

Definition 6.3.1 A set 7i of triples of the form (r,r',f) is a history-preserving bisimulation 
between nets N and N' iff 

1. If (r, r', f) G TC, then r and r' are runs of N and N', respectively, and / is an isomorphism 
between pomset-trace(r) and pomset-trace(r r ) . 

2. (e,e,0) G TC, where e is the empty transition-sequence. 

3. If (r,r',f) G 7i and r.t is a run of N, then there is some, possibly empty, sequence of 
transitions t[ . . . t' k and some function /' such that 

((r.t), (r'.t[ . . -t' k ), /') G 7i and /' restricted to pomset-trace(r) equals /. 

4. If (r,r',f) G 7i and r' .t' is a run of N', then there is some, possibly empty, sequence of 
transitions t x ■ ■ -t k and some function /' such that 

((r.t i . . .t k ), (r'.t 1 ), /') G 7i and /' restricted to pomset-trace(r) equals /. 

Vogler [46, 48] has given an alternate characterization of history-preserving bisimulation 
based on partially ordered sets of places, together with a decidability result. We give an alternate 
proof based on the approach presented in Section 6.2. We recall that the finite automaton 
described in Theorem 6.2.31 is deterministic, and we let update refer to its state-transition 
function. Furthermore, for any «-pair-sequence w and any gsc (3, we write update ((3, w) to 
mean the successive application of update to each of the pairs in w. For any net N , we write 
init(N) to denote the initial marking of N . 

Definition 6.3.2 A set Q of triples of the form (M, M', (3) is an gsc-bisimulation between nets 
N and N' iff 

1. If (M, M',(3) G Q, then M and M' are markings of N and N', respectively, and (3 is an 
isomorphism class of growth-site correspondences between N and N'. 

2. (init(N),init(N '),(&) G Q. 

3. If (M, M',(3) G Q and M[t)Mi for some transition t and some marking M l7 then there is 
some marking M[ and some «-pair-sequence w such that proji(w) = t, M'\proJ2(w))M[ 
and (M l ,M[, update((3, w)) G Q. 

4. Vice- versa; if (M,M',(3) G Q and M'[t')M[ for some transition t' and some marking M[, 
then there is some marking Mi and some «-pair-sequence w such that proj 2 (w) = t' , 
M\proji(w))Mi and (Mi,M[,update((3,w)) G Q. 

Lemma 6.3.3 Nets are history-preserving bisimilar iff they are gsc-bisimilar. 
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Proof. For one direction, let 7i be a history-preserving bisimulation between nets N and 
N'. Let 

G = {(M,M',gsc(r,r'j): (r,r' ,gsc(r,r')) £ H, init(N)[r)M and init(N')[r')M'}. 

Property (1) and (2) of Definition 6.3.2 follow easily from Definition 6.2.29 and Definition 6.3.1; 
the details are left to the reader. To prove property (3), let (M, M',/3) £ Q and let transition t 
and marking Mi be such that M[t)Mi. Clearly, there must be some (r,r', gsc(r,r')) £ 7i such 
that (3 = gsc(r, r r ), init(N)[r)M , and init(N')[r')M'. By Definition 6.3.1, r.t is a run of N, and 
so property (3) of Definition 6.3.1 implies the existence of some, possibly empty, sequence of 
transitions t[ . . .t' k and some function /' such that ((r.t), (r'.t\ . . -t' k ), /') £ 7i and /' restricted 
to pomset-trace(r) equals gsc(r,r'). Definition 6.3.1 implies that /' is an isomorphism between 
the pomset-traces of r.t and r' .t[ . . .t' k , from which it then follows easily from Definition 6.2.29 
that /' = gsc(r.t,r'.t[ . . .t' k ). The definition of •-sequences, the definition of update, and the 
definition of g then immediately imply that property (3) of Definition 6.3.2 must hold for g. 
A similar proof holds for property (4), and hence g is a gsc-bisimulation. 

For the other direction, let g be a gsc-bisimulation between nets N and N'. We define the 
set of triples 7i inductively as follows. For the basis step, let 7i = {(e,e,0)}. For one inductive 
step, if (r, r', f) £ 7i, and for some t, t[ . . .t' k , 

1. r.t is a run of N , r' .t[ . . .t' k is a run of N', and 

2. (M,M',gsc{r.t,r'.t\ . . .t' k j) £ g, where init(N)[r.t)M and init(N')[r' .t[ . ..t' k )M', 

then (r.t,r'.t[ . . .t' k ,a rAtrl . t > i .. A > k ) £ H. 

For the other inductive step, if (r, r', f) £ 7i, and for some t x . . .t k , t' , 

1. r.ti . . .t k is a run of N , r'.t' is a run of N', and 

2. (M,M',ffsc(r-.ii . . .t k ,r'.t')) £ Q, where i'm'f(iV)[r-.ii . . .t k )M and init(N')[r' .t')M' , 

then (r.t 1 . . .t k ,r'.t', a. r .t 1 ...t k ,r>.t>) G 'H- 

By the definition of gsc and the a, it is clear that properties (1) and (2) of Definition 6.3.1 
hold for 7i. To prove (3), suppose that (r, r' , f) £ 7i and r.t is a run of N. Then (M, M' , gsc(r, r')) £ 
g, where init(N)[r)M and init(N')[r')M' . Let Mi be the marking such that init(N)[r.t)Mi. 
Then by the definition of gsc-bisimulations, there is some marking M[ and some «-pair-sequence 
w such that proji(w) = t, M'[proJ2(w))M[ and (Mi, M[, update(gsc(r, r'), w) £ g. Let proj 2 (w) = 
t[ . . .t' k ; then by definition, update(gsc(r,r'),w) is isomorphic to gsc(r.t,r'.t[ . . .t' k ), 
so (r.t,r'.t\ . . .t' k ,a rAr i A i A i ) £ 7i. It is easy to see by the definition of a that a rAr i A i A i re- 
stricted to the pomset-trace of r is equal to a rr i , which is in turn equal to /, proving this case. 
The proof of (4) is analogous. ■ 

As in Section 6.2.2, it is easy to see that for any finite net, the number of triples (M, M' , (3) 
is bounded by an exponential in the sizes of the nets. We use this fact in our decision procedure: 

Theorem 6.3.4 For finite nets that may contain hidden transitions, history-preserving bisim- 
ulation can be decided in deterministic time exponential in the number of places and transitions 
in the nets. 
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Proof. The algorithm to decide history-preserving bisimulation of nets N and N' is similar 
to the decision procedure for (interleaving) bisimulation by successive refinement. We start with 
a set G that contains all possible triples, and each step, we shrink this set. Specifically, we 
define inductively: 

Go = {(M, M', fi) : M,M' are markings of N,N', 

and (3 is a gsc-isomorphism class between N and JV'} 

G i+1 = {(M, M',/3) G Gi '■ for every transition t and marking Mi with M[t)Mi, 

there is some marking M[ and some • -pair-sequence w 
such that proji(w) = t, M'\proJ2(w))M[, 
and (Mi, M[, update^, w)) G Gi 
and vice- versa} 

We now show that N and N' are gsc-bisimilar iff 

(init(N),init(N'),$) G Gk 

for any k that exceeds the number of possible triples (M, M',/3). For one direction, let Q' be a 
gsc-bisimulation between JV and N' . Using Definition 6.3.2, a simple induction on i shows that 
G' C t/j for all i > 0. Since Definition 6.3.2 implies that (init(N),init(N'),ty) G £/', we have 
that (init(N), init(N'),®) G £/&, as desired. For the other direction, we observe that for all i, 
Gi+i is either a strict subset of Gi or Gi = Gj for all j > i. Since A; is greater than the number 
of triples, it immediately follows that Gk = Gk+i- Thus, by Definition 6.3.2 and the definition 
of the Gi, Gk is a gsc-bisimulation whenever it contains (init(N),init(N 7 ),0). 

We observe that k is easily bounded by an exponential in the sizes of N and N'. It is also 
easy to check that Gk can be computed in DEXPTIME in the size of N and N' (using a transitive 
closure technique as in [26] to calculate the existence of a «-pair-sequence w). Thus, it can be 
checked in deterministic time exponential in the number of places and transitions in N and N' 
whether (init(N), init(N'), 0) G Gk, an d hence the theorem follows easily from Lemma 6.3.3. ■ 

We now define pomset-bisimulation. Our definition induces the same equivalence as that of 
[6, 39, 50]. 

Definition 6.3.5 A set V of pairs of the form (M, M') is a pomset-bisimulation between nets 
N and N' iff 

1. If (M, M') G V, then M and M' are markings of N and JV', respectively. 

2. (init(N),init(N')) G V. 

3. If (M,M r ) G V and M[r)Mi for some transition-sequence r and some marking Mi, then 
there is some transition-sequence r' and some marking M[ such that the pomset-traces 
of r and r' are isomorphic, M'[r')M[, and (Mi,M{) G V. 

4. Vice- versa; if (M, M') G V and M'[r')M[ for some transition-sequence r' and some mark- 
ing M[, then there is some transition-sequence r and some marking Mi such that the 
pomset-traces of r and r' are isomorphic, M[r)Mi, and (Mi,M{) G V . 
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Theorem 6.3.6 For finite nets that may contain hidden transitions, pomset-bisimulation can 
be decided in space exponential in the number of places and transitions in the nets. 

Proof. The algorithm to decide pomset-bisimulation of nets N and N' is also by successive 
refinement. We start with a set Vo that contains all possible pairs, and each step, we shrink 
this set. Specifically, we define inductively: 

V = {(M, M') : M, M' are markings of N, N'} 

Vi+i = {(M,M r ) G Vi : for every transition-sequence r and marking Mi with M[r)Mi, 

there is some transition-sequence r' and some marking M[ 
such that the pomset-traces of r and r' are isomorphic, 
M'[r')M[, and (M U M^) G Vi 
and vice- versa} 

It is straightforward to show that N and N' are pomset-bisimilar iff 

(init(N),init(N')) G V k 

for any k that exceeds the number of pairs, and this number is easily bounded by an exponential 
in the sizes of N and N'. To compute each Vi+i, we use the following straightforward modifi- 
cation of the decision procedure for pomset-trace equivalence. For each pair (M,M r ) G Vi, let 
N M be N, except that the initial marking of N M is M (rather than init(N)); net N' M , is defined 
similarly. As in the proof of Corollary 6.2.32, we intersect the automaton that recognizes the 
set of pairs of runs of N M and N' M , with the automaton of Theorem 6.2.31 constructed for N M 
and N' M ,. Each state of the resulting automaton is a pair of the form (/3, (M l7 M[)), where Mi 
is a state of N M and M[ is a state of N' M ,. For each state (/3, (M l7 M[)), we now add a new Mi- 
labeled transition iff (Mi,M[) G Vf, all such transitions lead to a single new, accepting state. 
All other states of the automaton are defined to be non-accepting. We then relabel the other 
transitions (u,u') as in the proof of Corollary 6.2.32. Thus, the language of this automaton is 
all pairs (r,M r ) of runs r and corresponding final marking M r of N M for which there is some 
run r' and corresponding final marking M' r , of N' M , such that r and r' are synchronous and 
(M r ,M' r i) G Vi. It is easy to see that the transition table of this modified automaton remains 
exponential in the sizes of N and N' . (An similar automaton is also constructed whose language 
is all pairs (r 1 ,M' r i) of runs r' and corresponding final marking M' r , of N' M , for which there is 
some run r and corresponding final marking M r of N M such that r and r' are synchronous and 
(M r ,M;,)GP 8 .) 

By Proposition 6.2.4, Definition 6.2.19, and Lemma 6.2.20, it is then straightforward to 
show that (M, M 1 ) G Vi+i iff (1) the language of the finite-state automaton given above is the 
set of all pairs (r,M r ) such that r is a run of N M and M[r)M r , and (2) the language of the 
similar automaton constructed for N' M , is the set of all pairs (r', M r <) such that r' is a run of N' M , 
and M'[r')M r i . It is easy to construct other finite-state automata of essentially the same size, 
recognizing the set of such pairs (r,M r ) or the set of such pairs (r',M r <). So (M,M r ) G Vi+i 
iff each of the two appropriate pairs of automata recognize the same language. Since language 
equivalence is checkable in space proportional to the size of the automata [22], each P 8 - can be 
computed in space exponential in the size of N and N', and hence so can P k . m 
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6.4 Deciding Other True Concurrency Equivalences 

Since the transition system of a net is a finite-state automaton, the decision procedures for the 
interleaving trace, failure and bisimulation equivalences for nets follow directly from the results 
of Kanellakis&Smolka [26] for finite-state automata. 

Theorem 6.4.1 For finite nets that may contain hidden transitions, the trace equivalence 
problem and the failure equivalence problem can be decided in space which is a product of an 
exponential in the number of places in the nets and a polynomial in the number of transitions 
in the nets. Furthermore, the bisimulation problem, the delay bisimulation problem, and the 
branching bisimulation problem can be decided in deterministic time which is a product of an 
exponential in the number of places in the nets and a polynomial in the number of transitions 
in the nets. 

Proof. The transition system of a finite net is a deterministic finite-state automaton 
whose states correspond to the reachable markings of the net and whose transitions correspond 
to transitions of the net. Let m and m' be the number of transitions in N and N', respectively, 
and let n and n' be the number of places in N and N', respectively. Then the maximum of the 
number of transitions in these automata is bounded by m ■ 2 max ^ n,n }, and the maximum of the 
number of states in these automata is bounded by 2 max ^ n,n }. Clearly, relabeling each visible 
transition t with the label of t and relabeling each hidden transition t' with e does not change 
the sizes of the automata. 

By definition, the finite nets are trace, failures, or bisimulation equivalent iff these finite-state 
automata with e-moves are respectively trace, failures, or bisimulation equivalent. Trace equiv- 
alence of finite-state automata is checkable in space proportional to the size of the automata 
[26], while bisimulation equivalence is checkable in PTIME [26], as are delay bisimulation and 
branching bisimulation [17]. The decision procedure for divergence-respecting failures equiv- 
alence [9] of finite-state automata is a straightforward generalization of Kannelakis&Smolka's 
PSPACE decision procedure for divergence-blind failures equivalence. ■ 

The decision procedures for most of the other true concurrency equivalences in Table 6.1 
then follow from reductions to the corresponding interleaving equivalences, which are part of 
known full abstraction proofs [23, 25, 47, 49]. 

Theorem 6.4.2 For finite nets that may contain hidden transitions, the step-trace equivalence 
problem and the step-failure equivalence problem can be decided in space exponential in the 
number of places and transitions in the nets. Furthermore, the step-bisimulation problem can 
be decided in deterministic time exponential in the number of places and transitions in the nets. 

Proof. By a known full abstraction result [25], there is a context C[-] involving only a 
self-synchronization operator [25] such that nets N and N' are step-trace, step-failures, or step- 
bisimulation equivalent iff the nets C[N] and C[iV] are respectively trace equivalent, failures 
equivalent, or bisimulation equivalent. In particular, C[-] adds a new transition for every set of 
pairwise statically concurrent transitions, and does not add any new places. 
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Let m and to' be the number of transitions in N and N', respectively, and let n and n' be 
the number of places in N and N', respectively. Then the maximum of the number of transi- 
tions in C[N] and C[iV] is bounded by 2 max ^ m,m 1, and the maximum of the number of places 
in C[N] and C[iV] is bounded by max{n, n'}. The proof then follows easily by Theorem 6.4.1. ■ 

The decision procedure for interval-pomset-trace equivalence and interval-pomset-failure 
equivalence relies on a full abstraction result involving action refinement: 

Theorem 6.4.3 For finite nets that may contain hidden transitions, the interval-pomset-trace 
equivalence problem and the interval-pomset-failures equivalence problem can be decided in 
space exponential in the number of places and transitions in the nets. 

Proof. By known full abstraction results [23, 47], there is a context C[-] built from 
split and choice refinements such that nets N and N' are interval-pomset-trace equivalent or 
interval-pomset-failures equivalent iff the nets C[N] and C[iV] are respectively trace equivalent 
or failures equivalent. In particular, C[-] refines every visible transition by the net af .aj~ + . . .+ 
a~l .a^ , where a is the label of the visible transition and k is bounded by the maximum of the 
number of transitions in N and N'. 

Let m and to' be the number of transitions in N and N', respectively, and let n and n' be the 
number of places in N and N', respectively. Then the maximum of the number of transitions in 
C[N] and C[iV] is bounded by 2 • max{m, to'} + 1, and the maximum of the number of places 
in C[N] and C[iV] is bounded by maxjra, n'} + max{m, to'} . The proof then follows easily by 
Theorem 6.4.1. ■ 

Vogler [49] has shown that the interval-pomset equivalences coincide with the ST-equivalences 
[39, 42]. We have as an immediate consequence: 

Theorem 6.4.4 For finite nets that may contain hidden transitions, the ST-trace equivalence 
problem and the ST-failure equivalence problem can be decided in space exponential in the 
number of places and transitions in the nets. Furthermore, the ST-bisimulation problem can be 
decided in deterministic time exponential in the number of places and transitions in the nets. 

Proof. The proofs for ST-traces and ST-failures is identical to that of Theorem 6.4.3, 
while the proof for ST-bisimulation uses the same context C[-] to yield a reduction to bisimu- 
lation. The desired upper bound then follows by Theorem 6.4.1. ■ 

Using the decision procedure for history-preserving bisimulation, a similar result holds for 
maximality-preserving bisimulation [13]: 

Theorem 6.4.5 For finite nets that may contain hidden transitions, the maximality-preserving 
bisimulation problem can be decided in deterministic time exponential in the number of places 
and transitions in the nets. 

Proof. Let C[-] be the net context involving split and choice refinements given in the 
proof of Theorem 6.4.3. Then by a proof similar to that of [45], nets N and N' are maximality- 
preserving bisimilar iff the nets C[N] and C[iV] are history-preserving bisimilar. The theorem 
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is then a simple consequence of Theorem 6.3.4. ■ 

Lastly, our decision procedure for pomset-bisimulation yields one for pomset-ST-bisimulation [50]: 

Theorem 6.4.6 For finite nets that may contain hidden transitions, the pomset-ST-bisimulation 
problem can be decided in space exponential in the number of places and transitions in the nets. 

Proof. Let C[-] be the net context involving split and choice refinements given in the 
proof of Theorem 6.4.3. Then by a proof similar to that of [45], nets N and N' are pomset- 
ST-bisimilar iff the nets C[N] and C[iV] are pomset-bisimilar. The theorem is then a simple 
consequence of Theorem 6.3.6. ■ 

6.5 Lower Bounds 

The lower bounds for trace equivalence and bisimulation essentially follow from previous results 
of Mayer&Stockmeyer on Mazurkiewicz nets and regular expressions with interleaving. In 
particular, Mayer&Stockmeyer [29] have shown the EXPSPACE-hardness of deciding whether the 
language of a regular expression with interleaving is X*. Our EXPSPACE lower bound for trace 
equivalence of finite 1-safe Petri nets follows by a polynomial-time reduction. For expository 
simplicity, we first give the proof for nets that may contain hidden transitions. 

Theorem 6.5.1 The problem of deciding whether the language of a regular expression with 
interleaving is X* is polynomial-time reducible to trace equivalence of finite nets that may 
contain hidden transitions. 

Proof. Let X be a finite alphabet consisting only of visible labels, and let y/ g - X be a 
visible label. For any regular expression r over X built from {U, *, •, ||}, we give an inductive 
translation to finite 1-safe nets with labels from X U {r, y/}. Each of these nets will have exactly 
one ^/-labeled transition, and the post-set of this transition will be empty. 

The translation, net, uses net operators defined in [23]; we do not repeat the definitions 
here. However, we slightly modify the internal choice operator presented there to ensure that 
the resulting nets always have exactly one ^/-labeled transition. This in turn guarantees that 
the translation net can be performed in polynomial-time; that is, for any regular expression 
r with interleaving, the net net(r) can be constructed in deterministic time polynomial in the 
number of symbols in r. 

For every a £ X, a is the net corresponding to a.yj . The • operator is modeled by the 
sequencing operator on nets. The * operator applied to a net N adds the initially marked 
places of N to the post-set of its ^/-labeled transition, relabels the ^/-transition with r, and 
hooks up a single new ^/-labeled transition to the set of initially marked places of N. The union 
operator applied to nets N and N' is modeled by the internal choice operator on nets except 
that in addition, the ^/-labeled transitions of N and N' are relabeled by r, one common new 
place is added to the postset of both of these relabeled transitions, and this new place feeds into 
a new ^/-labeled transition. The interleaving operator applied to nets N and N' is modeled by 
the non- communicating parallel composition operator on nets, in which N and N' are simply 
placed side by side but required to synchronize on ^/-labeled transitions. We note that since all 
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nets in the target of net have exactly one ^/-labeled transition, the non- communicating parallel 
composition operator takes only a trivial cross-product of the ^/-labeled transitions and hence 
adds no extra transitions (or places). This ensures that net is a polynomial-time translation in 
the length of r. 

It is straightforward to show by induction that each of the nets in the target of net will 
immediately reach a deadlocked state whenever its (necessarily unique) ^/-labeled transition 
fires. Furthermore, this ^/-labeled can be fired from any reachable marking, after first perform- 
ing a finite, possibly empty, sequence of other transitions. For any regular expression r with 
interleaving, it follows by a simple induction that 

L(r) = {v G S* | f-^/is a trace of net(r)}, 

where L(r) is the language of r. 

Let iV s . be the finite net with exactly |S| + 1 transitions, each uniquely labeled from SU{-^/}, 
and exactly one place, which is initially marked and is in the preset of all the transitions and in 
the post-set of all the transitions not labeled with y/. The set of traces of iV s . is the prefix closure 
of X* • y/. We show that for any regular expression r with interleaving, L(r) = X* iff net(r) 
and JVs* are trace equivalent. One direction follows immediately from the equality highlighted 
above. For the other direction, suppose L(r) = X*. Since firing the ^/-labeled transition 
immediately puts net(r) in a deadlocked state, clearly the traces of net(r) are contained in the 
traces of iV s .. For the reverse containment, it follows immediately from the highlighted equality 
that the set X* • y/ is contained in the traces of net(r). Since traces are prefix-closed, the set 
X* is also contained in the traces of net(r), and so net(r) and iV s . are trace-equivalent. 

This is a polynomial-time reduction from deciding whether the language of a regular ex- 
pressions with interleaving is X* to trace equivalence of finite nets with hidden transitions. ■ 

We then have as a corollary: 

Theorem 6.5.2 For finite nets that may contain hidden transitions, trace equivalence is EXPSPACE- 
hard. 

We now modify the proof of Theorem 6.5.1 to yield the lower bound for trace equivalence 
of finite nets without hidden transitions. 

Theorem 6.5.3 The problem of deciding whether the language of a regular expression with 
interleaving is X* is polynomial-time reducible to trace equivalence of finite nets without hidden 
transitions. 

Proof. Let net be the translation defined in the proof of Theorem 6.5.1, and let 1 g - 
(X* U {y/}) be a visible label. For any regular expression r with interleaving, we define a new 
translation Net from net(r) as follows: first, we relabel all r-labeled transitions in net(r) with 
the label 1, then for every place s in net(r), we add a new 1-labeled transition and put it in 
the preset and postset of the place s (i.e., in a self- loop under s). Net(r) is defined to be the 
resulting net, and clearly can be constructed in polynomial time in the length of r. Furthermore, 
Net(r) satisfies all the properties of net(r) specified in the proof of Theorem 6.5.1 concerning 
markings and -^/-labeled transitions. The labeled transition system of Net(r) is identical to that 
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of net(r), except that all r-labeled transitions are replaced by 1-labeled transitions, and every 
state has a 1-labeled transition trivially looping back to itself. 

It is straightforward to show by induction that for any regular expression r with interleaving, 
net(r) can perform at most 4 • \r\ consecutive r-moves, where \r\ is the number of symbols in r. 
By construction of Net(r), it then follows that: 

L(r) = {ai.-.a,, G E* | l 4 ' |r| ail 4 ' |r| . . .a Jfe l 4 ' l 'V is a trace of TVe^(r)}. 

For any regular expression r with interleaving, let N r be the finite net with 4 • \r\ + |S| + 1 
transitions and 4 • \r\ + 1 places, whose set of traces is the prefix-closure of (l 4 *' r ' • £)* • l 4 *' r ' • ^/; 
the intended definition of N r is obvious and omitted. By reasoning similar to that of the proof 
of Theorem 6.5.1, it follows that L(r) = X* iff the set of traces of Net(r) contains the set of the 
traces of N r . The details are left to the reader. 

To reduce trace-containment to trace equivalence, we observe that for any nets JVi and JV 2 , 
the set of traces of JVi contains the set of traces of N 2 iff the net (JVi || Su r / 2 i N 2 ) and the 
net N 2 are trace equivalent, where || Su r /ji is a parallel composition operator which requires 
synchronization on (visible) labels and hence corresponds to trace intersection. Furthermore, 
the size of JVi || Su r / 2 i N 2 is polynomial in the sizes of JVi and JV 2 , giving a polynomial-time 
reduction from trace containment to trace equivalence, and proving the theorem. ■ 

We then have as a corollary: 

Theorem 6.5.4 For finite nets without hidden transitions, trace equivalence is EXPSPACE-hard. 

Using these results, we obtain a lower-bound for failures equivalence; the proof is very 
similar to that of Kanellakis&Smolka [26] for finite-state automata. 

Theorem 6.5.5 For finite nets without hidden transitions, trace equivalence is polynomial- 
time reducible to failures equivalence. 

Proof. For any finite nets JVi and N 2 without hidden transitions, let N- be constructed 
by adding to JV; a single new, initially marked place, s n ew 5 which is placed in the preset and 
post-set of every transition of JV;. The labeled transition system of N- is isomorphic to that 
of JVj. Now, N" is constructed by adding to N- a new a-labeled transition t a , for every visible 
label a, and hooking up each t a so that its post-set is empty and its preset contains only the 
place % ew . All of the t a are enabled under every reachable marking of N-, and firing any one 
of them puts N" in a deadlocked state. 

Ni and N 2 are trace equivalent iff N" and N" are failures equivalent; the proof is identical 
to that of Kanellakis&Smolka [26] and is omitted. This is a polynomial-time reduction from 
trace equivalence to failures equivalence. ■ 

We then have as a corollary: 

Theorem 6.5.6 Failures equivalence of finite nets is EXPSPACE-hard. 

Our proof of a DEXPTIME lower bound for bisimulation is a simple adaptation of Stock- 
meyer's result [36] for Mazurkiewicz nets: namely, we reduce the acceptance problem for 
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polynomial-space Alternating Turing Machines to the bisimulation problem for finite 1-safe 
Petri nets. In particular, we simulate the tape and finite-state control of polynomial-space 
Alternating Turing Machines by polynomial-time constructible 1-safe Petri Nets, and our re- 
duction to bisimulation is essentially identical to that of Stockmeyer. Since Mazurkiewicz nets 
are somewhat more succinct than 1-safe Petri Nets, our lower bound for bisimulation is a minor 
technical improvement of the results of Stockmeyer. 

Theorem 6.5.7 The acceptance problem for polynomial-space Alternating Turing Machines 
is polynomial-time reducible to bisimulation of finite nets. 

Proof. Let A be an alternating Turing Machine that, for some polynomial p, uses 

p(n) space on input of size n. A well-known property of polynomial- space alternating Turing 
Machines is that every computation halts in deterministic time exponential in the size of the 
input [11, 27]. Let p'(n) be so large that 2 P ^ exceeds the time bound of A on input of 
size n, and let X be the finite tape alphabet of A. We can assume without loss of generality 
that A begins in an existential state, existential and universal states alternate at every step, 
and when A enters an accepting state it continues to take steps while staying in accepting 
states. Furthermore, we can assume that A has exactly two possible moves at every step, every 
existential state has at least one immediate successor that is a rejecting universal state, every 
universal state has at least one immediate successor that is an accepting existential state, and 
the final state of every computation is an existential state. 

For any input x, we first construct a polynomial-size Petri Net net(A x ) that "simulates" 
the computation of A on x. Each tape square i of A is represented as a group of places 
{s (itai) ,...,s (itak) }U (s(i, 3o ),...,S(i, 3! )}' wri ere S = {a u ...,a k } and {q ,...,q,} are the control 
states of A. The idea is that for each tape square i, exactly one of the places in {s(i, ai ), • • • , $(i,a k )} 
will be marked under every reachable marking, indicating which tape symbol is currently written 
on tape square i. Furthermore, over all 1 < i < p(n) and all < j < /, exactly one of S(i i3i ) is 
marked, indicating which tape square holds the head and which control state A is currently in. 
Let x = a il . . .a in ; then exactly the places {s(i, ai ), • • . ,S(„ ifli )} U {s(i, 3o )} are initially marked. 

The net net(A x ) is wired up as follows: for every tape square i, every control state q, every 
symbol cij £ X, and every control transition (q',cij>,D) £ 8(q,a,j) in A, where D is either L or 
R, net(A) contains a transition tl a ■)->(«' a-, £>)' labeled with some common label 1. The idea is 
that this transition fires iff A is currently in control state q and tape square i holds the head and 
contains cij. Firing this transition puts A in control state q' , writes ay on tape square i, and 
moves the head to tape square i — 1 if D = L and to tape square i + 1 if D = R. In particular, 
the preset of transition t l (qa r } ^ (ql a ^ D} is {s (ii3 ),s (iiai )} and the post-set is {s(;_i,«,'),S(;, v )} or 
{s(i+i, 3 '),S(i,a-,)} depending on whether D is L or R. Finally, for every accepting existential 
control state q and tape square i, we introduce a transition X^^ with preset {s(i, 3 )}, empty 
postset, and label ace. For every rejecting existential control state q and tape square i, we 
introduce a transition X^^ with preset {s(i, 3 )}, empty postset, and label ace, and a transition 
Y(i <q ) with preset {s(i, 3 )}, empty postset, and label rej. Clearly, net(A x ) contains (k + /) • p(n) 
places and at most (2/ + to) • p(n) transitions, where k is the size of the tape alphabet of A, I 
is the number of control states of A, and m is the number of control transitions of A. 

It is straightforward to show that net(A x ) is 1-safe, sequential (i.e., no transitions can fire 
concurrently under any reachable marking), and that its labeled transition system is isomorphic 



6.5. LOWER BOUNDS 



145 




V(a) 



V(r)^ 



3(r)- 
rej 



Figure 6-4: Labeled Transition System of N F 



to that of A on input x, ignoring the labels of the control transitions, and ignoring the acc- 
labeled and rej-labeled transitions altogether. 

Let T be the deterministic Turing machine which, started with a string of O's on its tape, 
successively adds 1 to the binary number on its tape until the original string of O's is changed into 
a string of l's (of the same length). Then T enters an accepting state and halts. So, when started 
on a string on m O's, it runs for at least 2 m steps and halts. The polynomial-time translation 
net given above for alternating Turing Machines also holds for any deterministic polynomial- 
space Turing Machine, except that we add both acc-labeled and rej-labeled transitions for 
every pair (i,q). Hence if "started" on input consisting of a string of p'(|a;|) O's, this net is of 
size bounded by some polynomial in \x\, and has the sole behaviors that it fires at most some 
fixed m! > 2 P ^ x ^ number of l's, and each point along the way it non-deterministically chooses 
between firing either ace or rej and exiting, or firing a 1. Furthermore, after firing m' l's 
followed by a single ace or rej, it reaches a deadlocked state. We call this net Count(ra'). We 
can assume without loss of generality that m' is odd, and since m' exceeds the time bound of 
A on input x, we can assume without loss of generality that every computation path of A on 
input x is exactly of length to'. 

To finish the construction, let N F be a finite 1-safe net of constant size with the labeled 
transition system pictured in Figure 6-4, and let N x = N F || laccre i Count(ra'), where 
synchronization is required on the symbols 1, ace, and rej. N x is of size polynomial in \x\, and 
its labeled transition system is bisimilar to the transition system pictured in Figure 6-5. 

We now show that net(A x ) is bisimilar to the net N x iff A accepts input x. For one direction, 
suppose that net(A x ) is bisimilar to N x ; then net(A x ) must have some ra'-length path bisimilar 
to 3(a)\/(a)3(a)\/(a) . . .3(a) after which it fires an acc-labeled transition. Thus, all the states of 
net(A x ) that are reached along the way must be accepting. Since the labeled transition system 
of net(A x ) is essentially isomorphic to the labeled transition system of A on x, A must accept x. 
Recalling our assumptions on A, the other direction follows by a simple induction on ~ 8 -, where 
~j is an i-step bisimulation (c/. [30]). This is a polynomial-time reduction from the acceptance 
problem for polynomial-space alternating Turing Machines to bisimulation of finite nets. ■ 
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Figure 6-5: Bisimilar to the Labeled Transition System of N x 
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It is well-known that the class of problems decidable in polynomial space by alternating 
Turing Machines is the same as the class of problems decidable in deterministic exponential 
time by ordinary Turing Machines [11, 27]. We then have as a simple corollary of this fact and 
Theorem 6.5.7: 

Theorem 6.5.8 Bisimulation of finite nets is DEXPTlME-hard. 

We now show the lower bounds for the remaining equivalences listed in Table 6.1. 

Theorem 6.5.9 For finite nets, 

1. trace equivalence is polynomial-time reducible to step-trace equivalence, ST-trace equiv- 
alence, interval pomset-trace equivalence, and pomset-trace equivalence, 

2. failures equivalence is polynomial-time reducible to step-failures equivalence, ST-failures 
equivalence, and interval pomset-failures equivalence, and 

3. bisimulation is polynomial-time reducible to step-bisimulation, ST-bisimulation, history- 
preserving bisimulation, maximality-preserving bisimulation, pomset-bisimulation, and 
pomset- ST-bisimulation. 

Proof. We give the proof only for pomset-trace equivalence, as the other cases are com- 
pletely analogous. For any finite nets Ni,N 2 without hidden transitions, let N- be constructed 
by adding to JV; a single new, initially marked place which is placed in the preset and post-set of 
every transition of JV;. Clearly, N- is trace equivalent to JV;. Since no transitions in N- are stat- 
ically concurrent, it is easy to see that N[ and N' 2 are trace equivalent iff they are pomset-trace 
equivalent; hence JVi and N 2 are trace equivalent iff N[ and N' 2 are pomset-trace equivalent. 
This is a polynomial-time reduction from trace equivalence to pomset-trace equivalence. ■ 

We then have as a simple corollary: 
Theorem 6.5.10 For finite nets, the decision problems for 

1. step-trace equivalence, ST-trace equivalence, interval pomset-trace equivalence, and pomset- 
trace equivalence are EXPSPACE-hard, 

2. step-failures equivalence, ST-failures equivalence, and interval pomset-failures equivalence 
are EXPSPACE-hard, 

3. delay bisimulation, branching bisimulation, step-bisimulation, ST-bisimulation, history- 
preserving bisimulation, maximality-preserving bisimulation, pomset-bisimulation, and 
pomset-ST-bisimulation are DEXPTlME-hard. 

Proof. Delay bisimulation and branching bisimulation coincide with bisimulation for 
nets without hidden transitions [43]. The lower bound for delay bisimulation and branching 
bisimulation is thus a simple consequence of Theorem 6.5.8. All the other lower bounds follow 
immediately from Theorems 6.5.4, 6.5.6, 6.5.8, and 6.5.9. ■ 

We remark that all the lower bound results in this section are independent of the presence of 
hidden transitions, except as specifically stated in the lower bound proofs for trace equivalence. 
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6.6 Conclusions 

We remark that all these complexity results apply equally to process approximation as well 
as equivalence. An open problem is the decidability and complexity of augmentation- closed 
pomset-trace equivalence. Another open problem that we regard as especially significant is the 
decidability and complexity of our earlier general pomset-failures semantics [23], which keeps 
track of concurrent divergences. We are currently working to extend our methods to handle 
these cases. 



Chapter 7 

Other Results, Open Problems, and 
Future Work 



There is not yet a consensus on what an action refinement operator should be. For example, 
our action refinement operator and that of [47] are tuned to a CSP-style synchronization- 
with-restriction, while those of [3, 20] are tuned to a CCS-style synchronization-by-hiding- 
complementary- actions. In this regard, an action-refinement theory closely related to ours 
has been proposed by Hennessy [20]. His theory incorporates an interesting, and in certain 
respects more powerful, action refinement operation, and he has compositionality and full ab- 
straction results similar to ours. Unlike our action refinement operation, Hennessy's definition 
allows "concurrent" refinement nets to "communicate" with one another in a manner closely 
related to CCS-style parallel composition, where concurrent, complementary actions (i.e., a and 
a) can synchronize and perform a hidden move. However, in order for Hennessy's semantics 
to remain compositional for this powerful sort of action refinement, this inter-communication 
must in fact be quite restricted: in particular, "initial" hidden communications between re- 
finement nets must be disallowed. As a result, Hennessy forbids some simple action refine- 
ments like (a \ b)[a:=c, b:=c\. We have explored the connection between Hennessy's and 
our theories of action refinement in [25]. In particular, [25] presents a new operator of self- 
synchronization, which allows concurrent transitions within a process to synchronize, and shows 
that self-synchronization provides a tight connection between our action refinement operator 
and Hennessy's communicating action refinement operator. Furthermore, self-synchronization 
can detect "steps" of concurrent actions, and hence non-interleaving semantics are not compo- 
sitional. 

In a related direction, we believe that true concurrency semantics may reveal a distinction 
between existing synchronization operators for which non-interleaving semantics are compo- 
sitional. For example, in interleaving theories like CSP and CCS, the choice of operators is 
immaterial since the different synchronization operators can simulate each other. However, 
the known simulations do not preserve true concurrency semantics. The relation between the 
process theories based on these different synchronization mechanisms remains an interesting 
question, which we are currently exploring. 

This thesis has shown that our [•] MAY ,[']^ut S -7 an d ['IJputX are compositional for all our 
operators, including action refinement, and are respectively adequate for MAY-, MUST-, and 
Testing-equivalence. However, it remains open as to which sorts of observations these semantics 
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are fully abstract. To this end, we are currently working on a theory of local observers, which 
we believe will be able to detect full causality and concurrency through experiments. 

In Chapter 4, we showed that all of our semantical spaces form complete partial orders, and 
that our action refinement and CCS/CSP operators on nets correspond to continuous semantical 
operations. Consequently, we expect that our theory will routinely support arbitrary (not merely 
guarded) recursive definitions of nets, with recursion understood as usual via least fixed points. 
We hope to formalize these definitions in the near future. 

An important direction for further research is development of the algebra of process terms 
with refinement. One immediate problem to consider is finding a complete axiom system for 
equations between closed recursion-free CSP/CCS process terms — corresponding to the (non- 
divergent) isolated elements in our semantical spaces. 
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